Détails IP 165.232.120.46

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Règle WAF « ssrf-3 » · confiance 50%

Confiance 50 % — Score WAF 96 · 4 tag(s) WAF

Comparaison ASN / FAI

ASN 14061 · 165.232.112.0/20 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 7 événements sur la période pour cette IP.

147.182.225.86 Sonde port 23/07/2026 14:23 UTC
147.182.202.179 Sonde port 23/07/2026 14:23 UTC
137.184.112.103 Cross-site scripting 23/07/2026 14:23 UTC
209.38.70.156 Sonde port 23/07/2026 14:22 UTC
159.89.124.112 Sonde port 23/07/2026 14:22 UTC
143.198.150.150 Sonde port 23/07/2026 14:22 UTC
146.190.149.252 Sonde port 23/07/2026 14:22 UTC
146.190.153.30 Sonde port 23/07/2026 14:21 UTC

IPs apparentées

Même FAI DigitalOcean, LLC — corrélation indicative.

147.182.225.86 Sonde port
147.182.202.179 Sonde port
137.184.112.103 Cross-site scripting
209.38.70.156 Sonde port
159.89.124.112 Sonde port

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

CASSANDRA TCP 2 HTTP TCP 2 INFLUXDB TCP 1 SAP Diag TCP 1 SMB TCP 1

CASSANDRA

2

HTTP

2

INFLUXDB

1

SAP Diag

1

SMB

1

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

7 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
23/07/2026 08:52:26 UTC	TCP	11434 · HTTP	http	SSRF ssrf attack · via HTTP:11434 · (tentative d'exploit)	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 11434 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Élevé · 65 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:11434 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: / Acce Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:11434 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "033dedd926f028341b5d0b4ba132f8088c552b7c", "http_host_hash": "0edcf6ab7022a3c1a90b1ad0670bd95a56782eca", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 149, "payload_entropy": 5.121741695944114, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "DE", "dst_port": 11434, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 25 }, "risk_score": 65, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f95ea9be6c4a9b1fad0d833b420cac1468ebe31f", "event_fingerprint": "b08f0c76b5b2feb81564c7f55a39edfeae182905", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 25, "risk_score": 65 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "DE", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9f9c7ebc5d6f6c8d69ee2392fa6e3a4f", "payload_hash": "64e237be911c59fe64ef715bde660e47", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 11434, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAcce", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAcce", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAcce", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2c89207bbe114b2984a922a957af47d7a46ac1db", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAcce", "attack_vector": "ssrf attack \u00b7 via HTTP:11434 \u00b7 (tentative d'exploit)", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 25, "risk_score": 65 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 11434, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)", "port": 11434, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:11434 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAcce", "target_port_label": "11434 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "11434" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ], "asn_dc_heuristic": true }
23/07/2026 06:37:59 UTC	TCP	4891 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:4891 · (tentative d'exploit) · → /v2/_catalog	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /v2/_catalog UA Go-http-client/1.1 Émulateur HTTP WAF 14 Recommandation Investiguer Tags 950316:lfi-14 950468:nosqli-3 http_probe_registry http_ua_suspicious Cible HTTP GET /v2/_catalog TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4891 Chemin / cible /v2/_catalog Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 52 Confiance : Confiance 59 % — 2 tag(s) WAF Signaux CRS-930100-sub Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /v2/_catalog HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF lfi-14 nosqli-3 Payload (extrait) GET /v2/_catalog HTTP/1.1 Host: 62.3.50.33:4891 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut { "http_header_count": 3, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "f123d17c1f044862e7bbe35405632fe8bef9cb36", "http_target_hash": "0a123e4bf77be2af9aa43488b1d007835b4ab56c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 103, "payload_entropy": 4.975790038924918, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "DE", "dst_port": 4891, "risk_waf": 64, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 64, "classification": 78, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 52, "tag_count": 4, "anomaly_count": 0, "campaign_key": "19c2e7c7dc812351943791ee452077b8356cd438", "event_fingerprint": "cc16ec59e43313ce6022829bc700f2d54f5b2efc", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "CRS-930100-sub" ], "kb_rule_ids": [ "CRS-930100-sub" ], "confidence_breakdown": { "waf": 64, "classification": 78, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 52 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "DE", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "b95c2f2603fa45bf67a3a6ec3a9843f6", "path_pattern_hash": "e619279e9365734b3a57aa3a63edbea8" }, "target_context": { "dst_port": 4891, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:4891\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n", "method": "GET", "path": "\/v2\/_catalog", "user_agent": "Go-http-client\/1.1", "waf_tags": [ "950316:lfi-14", "950468:nosqli-3" ], "waf_rule_names": [ "lfi-14", "nosqli-3" ], "request_line": "GET \/v2\/_catalog HTTP\/1.1", "request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:4891\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:4891\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "evidence": { "method": "GET", "path": "\/v2\/_catalog", "user_agent": "Go-http-client\/1.1", "waf_tags": [ "950316:lfi-14", "950468:nosqli-3" ], "waf_rule_names": [ "lfi-14", "nosqli-3" ], "request_line": "GET \/v2\/_catalog HTTP\/1.1", "request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:4891\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:4891\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a2e060d1fabb251958c28e7145b9f81a7ef57f41", "protocol_details": { "http_method": "GET", "http_path": "\/v2\/_catalog", "request_line": "GET \/v2\/_catalog HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 4891, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:4891\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "attack_vector": "lfi path traversal \u00b7 via HTTP:4891 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog", "target_port_label": "4891 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP", "confidence_pct": 59, "confidence_breakdown": { "waf": 64, "classification": 78, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 52 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 4891, "protocol_emulated": null, "tags_summary": [ "CRS-930100-sub" ], "tags_summary_labels_fr": [ "CRS-930100-sub" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/v2\/_catalog", "request_line": "GET \/v2\/_catalog HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 4891, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:4891 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog", "evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:4891\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "target_port_label": "4891 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "4891" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950316:lfi-14", "950468:nosqli-3", "http_probe_registry", "http_ua_suspicious" ], "asn_dc_heuristic": true }
22/07/2026 17:45:11 UTC	TCP	445 · SMB	smb	imap bruteforce imap bruteforce · via SMB:445 · (sonde / probe)	Élevée	Moyen · 41
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1110 TA0007 TA0001 Protocole Émulateur SMB WAF — Recommandation Surveiller Tags http_get_probe imap_probe net_smb_probe smb_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 445 Chemin / cible — Service SMB Payload GET /cgi-bin/authLogin.cgi HTTP/1.1 Host: 62.3.50.33:445 User-Agent: Go-http-client/1.1 Connection: close Pourquoi cette classification : Type « imap_bruteforce » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 41 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux Email Imap Login Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /cgi-bin/authLogin.cgi HTTP/1.1 Host: 62.3.50.33:445 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000048", "emulator_response_len": 4, "bytes_in": 112, "payload_entropy": 4.931058861339195, "port_category": "well_known", "org": "DigitalOcean, LLC", "service": "smb", "app_proto": "smb", "asn": 14061, "country": "DE", "dst_port": 445, "risk_waf": 8, "risk_classification": 66, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 46, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 66, "behavior": 0, "geo": 40, "protocol": 46, "novelty": 15 }, "risk_score": 41, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ce04a850f3e420575696d586c8dbfb4a1009c70e", "event_fingerprint": "c2dcd725f3d49cc7233ad16d1772dcd2f3d0439d", "classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 76, "precision_signals": [ "INT-EMAIL-imap-login" ], "kb_rule_ids": [ "INT-EMAIL-imap-login" ], "confidence_breakdown": { "waf": 8, "classification": 66, "behavior": 0, "geo": 40, "protocol": 46, "novelty": 15, "risk_score": 41 }, "named_classification_skipped": false, "service_name": "smb", "risk_confidence_factor": 95, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "DE", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6572e4c80df839d79eb51384b33fd3e3", "path_pattern_hash": "d01bbf3f52d5029936b2dffb0f5e856f" }, "target_context": { "dst_port": 445, "service": "smb", "service_name": "smb", "risk_score": 41 }, "payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n", "request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "evidence": { "request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1110" ], "mitre": "T1110", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "25e8c4e66c138f9384152d3b8b4883fb8f6b5a42", "protocol_details": { "payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "port": 445, "service": "smb", "service_label_fr": "SMB" }, "evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "attack_vector": "imap bruteforce \u00b7 via SMB:445 \u00b7 (sonde \/ probe)", "target_port_label": "445 \u00b7 SMB", "emulator_service": "smb", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 66, "behavior": 0, "geo": 40, "protocol": 46, "novelty": 15, "risk_score": 41 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 41, "risk_label": "Moyen", "service_name": "smb", "service_label_fr": "SMB", "dst_port": 445, "protocol_emulated": true, "tags_summary": [ "INT-EMAIL-imap-login" ], "tags_summary_labels_fr": [ "Email Imap Login" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1110", "mitre_technique": "T1110", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-smb", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "port": 445, "service": "smb", "service_label_fr": "SMB" }, "attack_vector": "imap bruteforce \u00b7 via SMB:445 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:445\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "target_port_label": "445 \u00b7 SMB", "emulator_service": "smb", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "smb", "service_banner": "honeypot-smb", "service_os": "linux", "dst_port": "445" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "imap_probe", "net_smb_probe", "smb_emulated" ], "asn_dc_heuristic": true }
22/07/2026 10:33:32 UTC	TCP	18789 · SAP Diag	sap-diag	Sonde SAP Diag/GUI Sonde SAP Diag/GUI · via SAP Diag:18789 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SAP-DIAG WAF — Recommandation Surveiller Tags http_get_probe net_sap_diag_probe sap_diag_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 18789 Chemin / cible — Service SAP Diag Payload GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1 Host: 62.3.50.33:18789 User-Agent: Go-http-client/1.1 Connection: close Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 3 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1 Host: 62.3.50.33:18789 User-Agent: Go-http-client/1.1 Connection: close Meta JSON brut { "bytes_in": 117, "payload_entropy": 5.294927682429393, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "sap-diag", "app_proto": "sap-diag", "asn": 14061, "country": "DE", "dst_port": 18789, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 48, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 40, "protocol": 48, "novelty": 15 }, "risk_score": 24, "tag_count": 3, "anomaly_count": 0, "campaign_key": "93c35b709cd1da9ade41b5cd30820c9cd806f8f6", "event_fingerprint": "126c212c6be954ce59820946d6b66065dfe19769", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 40, "protocol": 48, "novelty": 15, "risk_score": 24 }, "named_classification_skipped": false, "service_name": "sap-diag", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "DE", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "246eab19882625b9ecad06dd168ea462", "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87" }, "target_context": { "dst_port": 18789, "service": "sap-diag", "service_name": "sap-diag", "risk_score": 24 }, "payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n", "request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "evidence": { "request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n", "payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "sap_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "59cca65c6201621dab3325b11f47545a6137149f", "protocol_details": { "payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "port": 18789, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:18789 \u00b7 (sonde \/ probe)", "target_port_label": "18789 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%", "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 40, "protocol": 48, "novelty": 15, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "sap-diag", "service_label_fr": "SAP Diag", "dst_port": 18789, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-diag", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "port": 18789, "service": "sap-diag", "service_label_fr": "SAP Diag" }, "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:18789 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close", "target_port_label": "18789 \u00b7 SAP Diag", "emulator_service": "sap-diag", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_diag", "service_banner": "honeypot-sap-diag", "service_os": "linux", "dst_port": "18789" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "net_sap_diag_probe", "sap_diag_probe" ], "asn_dc_heuristic": true }
20/07/2026 18:09:35 UTC	TCP	8086 · INFLUXDB	influxdb	Sonde InfluxDB influxdb probe · via INFLUXDB:8086 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur INFLUXDB WAF — Recommandation Surveiller Tags influxdb_emulated influxdb_payload net_influxdb_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8086 Chemin / cible — Service INFLUXDB Payload $ EƜHժ~~�Z��<�- ;AyvC�玺Ct�f �#�!p,Z�;��A�O�R��+;�_-��>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Pourquoi cette classification : Type « influxdb_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) $ EƜHժ~~�Z��<�- ;AyvC�玺Ct�f �#�!p,Z�;��A�O�R��+;�_-��>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Requête brute (extrait) $ EƜHժ~~�Z��<�- ;AyvC�玺Ct�f �#�!p,Z�;��A�O�R��+;�_-��>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3��=<5/�� # ( + - Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a582d496e666c757864622d56657273696f6e3a20322e372e340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b226e616d65223a22686f6e6579706f742d696e666c7578222c226d6573", "emulator_response_len": 165, "bytes_in": 297, "payload_entropy": 5.816857328134461, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "influxdb", "app_proto": "influxdb", "asn": 14061, "country": "DE", "dst_port": 8086, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.6, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 4, "anomaly_count": 0, "campaign_key": "616d33e8b5edab9d02f533b6029e3545f5563b64", "event_fingerprint": "a36e838654a329836d00a8ed03fe3d1cba6e1fed", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab influxdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 45 }, "service_name": "influxdb", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "DE", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0e362c9bd869432c488a0401c42e897d", "path_pattern_hash": "4c5f284725807ee704527650cfbb162b" }, "target_context": { "dst_port": 8086, "service": "influxdb", "service_name": "influxdb", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003E\u019cH\u056a~~\ufffd\u001fZ\ufffd\ufffd\ufffd<\ufffd-\n;AyvC\ufffd\u73baCt\ufffdf \ufffd#\u000e\ufffd!p,Z\ufffd;\ufffd\u001b\u0004\ufffd\ufffdA\ufffdO\ufffdR\ufffd\ufffd\ufffd+;\ufffd_-\u001c\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003E\u019cH\u056a~~\ufffd\u001fZ\ufffd\ufffd\ufffd<\ufffd-\n;AyvC\ufffd\u73baCt\ufffdf \ufffd#\u000e\ufffd!p,Z\ufffd;\ufffd\u001b\u0004\ufffd\ufffdA\ufffdO\ufffdR\ufffd\ufffd\ufffd+;\ufffd_-\u001c\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003E\u019cH\u056a~~\ufffd\u001fZ\ufffd\ufffd\ufffd<\ufffd-\n;AyvC\ufffd\u73baCt\ufffdf \ufffd#\u000e\ufffd!p,Z\ufffd;\ufffd\u001b\u0004\ufffd\ufffdA\ufffdO\ufffdR\ufffd\ufffd\ufffd+;\ufffd_-\u001c\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "classification_reason": "Type \u00ab influxdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0d0cf6ae3edf5f45263f2e8a709e665196fad79e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003E\u019cH\u056a~~\ufffd\u001fZ\ufffd\ufffd\ufffd<\ufffd-\n;AyvC\ufffd\u73baCt\ufffdf \ufffd#\u000e\ufffd!p,Z\ufffd;\ufffd\u001b\u0004\ufffd\ufffdA\ufffdO\ufffdR\ufffd\ufffd\ufffd+;\ufffd_-\u001c\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "port": 8086, "service": "influxdb", "service_label_fr": "INFLUXDB" }, "evidence_snippet": "$ E\u019cH\u056a~~\ufffdZ\ufffd\ufffd\ufffd<\ufffd-\n;AyvC\ufffd\u73baCt\ufffdf \ufffd#\ufffd!p,Z\ufffd;\ufffd\ufffd\ufffdA\ufffdO\ufffdR\ufffd\ufffd\ufffd+;\ufffd_-\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd", "attack_vector": "influxdb probe \u00b7 via INFLUXDB:8086 \u00b7 (sonde \/ probe)", "target_port_label": "8086 \u00b7 INFLUXDB", "emulator_service": "influxdb", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab influxdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab influxdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "influxdb", "service_label_fr": "INFLUXDB", "dst_port": 8086, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-influxdb", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003E\u019cH\u056a~~\ufffd\u001fZ\ufffd\ufffd\ufffd<\ufffd-\n;AyvC\ufffd\u73baCt\ufffdf \ufffd#\u000e\ufffd!p,Z\ufffd;\ufffd\u001b\u0004\ufffd\ufffdA\ufffdO\ufffdR\ufffd\ufffd\ufffd+;\ufffd_-\u001c\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "port": 8086, "service": "influxdb", "service_label_fr": "INFLUXDB" }, "attack_vector": "influxdb probe \u00b7 via INFLUXDB:8086 \u00b7 (sonde \/ probe)", "evidence_snippet": "$ E\u019cH\u056a~~\ufffdZ\ufffd\ufffd\ufffd<\ufffd-\n;AyvC\ufffd\u73baCt\ufffdf \ufffd#\ufffd!p,Z\ufffd;\ufffd\ufffd\ufffdA\ufffdO\ufffdR\ufffd\ufffd\ufffd+;\ufffd_-\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd", "target_port_label": "8086 \u00b7 INFLUXDB", "emulator_service": "influxdb", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "influxdb", "service_banner": "honeypot-influxdb", "service_os": "linux", "dst_port": "8086" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "influxdb_emulated", "influxdb_payload", "net_influxdb_probe", "tls_clienthello" ], "asn_dc_heuristic": true }
20/07/2026 17:44:55 UTC	TCP	9042 · CASSANDRA	cassandra	Sonde PostgreSQL postgres probe · via CASSANDRA:9042 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 1b9bb541fa237aff SNI 62.3.50.33 Émulateur CASSANDRA WAF — Recommandation Surveiller Tags cassandra_emulated net_cassandra_native tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9042 Chemin / cible — Service CASSANDRA SNI TLS 62.3.50.33 Payload ��9 �/��1�6�g�u�� yD��x��4�P�/�+�� /5� �$�#��(�'̨̩̪kg93=<��,�0 Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��9�/��1�6�g�u�� yD��x��4�P�/�+�� /5� �$�#��(�'̨̩̪kg93=<��,�0 Requête brute (extrait) ��9 �/��1�6�g�u�� yD��x��4�P�/�+�� /5� �$�#��(�'̨̩̪kg93=<��,�0G 62.3.50.33 � Meta JSON brut { "protocol_emulated": true, "emulator_response": "840000000200000002", "emulator_response_len": 9, "bytes_in": 201, "payload_entropy": 5.057472370561788, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "cassandra", "app_proto": "cassandra", "asn": 14061, "country": "DE", "dst_port": 9042, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "40a95b0e32b0df6949d23e1558297d2ebdc45aed", "event_fingerprint": "a0aaefdb49226dd6e2577aeda4227e02b3ddd691", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "cassandra", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "DE", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "181f86cb18bc598d0c5ab29f3af4d378", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "ja3": "1b9bb541fa237aff65acf838b154df7f", "ja4": "7d55a26b02c27f625ff34bc84f8ab649", "tls_version": "0x0303", "tls_cipher_count": 40, "tls_sni": "62.3.50.33", "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "1b9bb541fa237aff65acf838b154df7f", "tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49160-158-157-156-49192-49191-52393-52392-52394-107-103-57-51-22-61-60-4-20-159-21-49196-49200-8-6-3,0-5-10-11-13-65281,23-24-25,0", "tls_ja4_hash": "7d55a26b02c27f625ff34bc84f8ab649", "tls_ja4": "t13d0140_c79c1c2c7c3c_40d2e578a3e2", "tls_version": "0x0303", "tls_cipher_count": 40, "tls_sni": "62.3.50.33", "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 9042, "service": "cassandra", "service_name": "cassandra", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\f\ufffd\/\ufffd\ufffd1\ufffd6\ufffdg\ufffdu\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdyD\ufffd\ufffd\ufffdx\ufffd\ufffd4\ufffd\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\f\ufffd\/\ufffd\ufffd1\ufffd6\ufffdg\ufffdu\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdyD\ufffd\ufffd\ufffdx\ufffd\ufffd4\ufffd\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000\u0000G\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\f\ufffd\/\ufffd\ufffd1\ufffd6\ufffdg\ufffdu\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdyD\ufffd\ufffd\ufffdx\ufffd\ufffd4\ufffd\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6b83ce335b34bd97c5e5ad7c3cac08a80db3afc9", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\f\ufffd\/\ufffd\ufffd1\ufffd6\ufffdg\ufffdu\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdyD\ufffd\ufffd\ufffdx\ufffd\ufffd4\ufffd\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000", "tls_ja3": "1b9bb541fa237aff65acf838b154df7f", "tls_ja4": "7d55a26b02c27f625ff34bc84f8ab649", "tls_sni": "62.3.50.33", "port": 9042, "service": "cassandra", "service_label_fr": "CASSANDRA" }, "evidence_snippet": "\ufffd\ufffd9\ufffd\/\ufffd\ufffd1\ufffd6\ufffdg\ufffdu\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdyD\ufffd\ufffd\ufffdx\ufffd\ufffd4\ufffdP\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd'\u0329\u0328\u032akg93=<\ufffd\ufffd,\ufffd0", "attack_vector": "postgres probe \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)", "target_port_label": "9042 \u00b7 CASSANDRA", "emulator_service": "cassandra", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "cassandra", "service_label_fr": "CASSANDRA", "dst_port": 9042, "protocol_emulated": true, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cassandra", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039\f\ufffd\/\ufffd\ufffd1\ufffd6\ufffdg\ufffdu\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdyD\ufffd\ufffd\ufffdx\ufffd\ufffd4\ufffd\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000", "tls_ja3": "1b9bb541fa237aff65acf838b154df7f", "tls_ja4": "7d55a26b02c27f625ff34bc84f8ab649", "tls_sni": "62.3.50.33", "port": 9042, "service": "cassandra", "service_label_fr": "CASSANDRA" }, "attack_vector": "postgres probe \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd9\ufffd\/\ufffd\ufffd1\ufffd6\ufffdg\ufffdu\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdyD\ufffd\ufffd\ufffdx\ufffd\ufffd4\ufffdP\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd'\u0329\u0328\u032akg93=<\ufffd\ufffd,\ufffd0", "target_port_label": "9042 \u00b7 CASSANDRA", "emulator_service": "cassandra", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cassandra", "service_banner": "honeypot-cassandra", "service_os": "linux", "dst_port": "9042" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "cassandra_emulated", "net_cassandra_native", "tls_clienthello" ], "asn_dc_heuristic": true }
20/07/2026 17:44:54 UTC	TCP	9042 · CASSANDRA	cassandra	Protocole natif Cassandra cassandra native · via CASSANDRA:9042 · (sonde / probe)	Élevée	Faible · 37
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CASSANDRA WAF — Recommandation Surveiller Tags cassandra_emulated http_get_probe mozi_pattern net_cassandra_native Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9042 Chemin / cible — Service CASSANDRA Payload GET / HTTP/1.1 Host: 62.3.50.33:9042 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: / Accep Pourquoi cette classification : Type « cassandra_native » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 37 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9042 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: / Accep Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9042 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "840000000200000002", "emulator_response_len": 9, "bytes_in": 148, "payload_entropy": 5.1417076098349215, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "cassandra", "app_proto": "cassandra", "asn": 14061, "country": "DE", "dst_port": 9042, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15 }, "risk_score": 37, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8cc2731612d020ecdcab58b5df800413f79ea60", "event_fingerprint": "a0aaefdb49226dd6e2577aeda4227e02b3ddd691", "classification_reason": "Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "cassandra", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "DE", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3d7db0c7621e936e9d1257ed1b89b879", "path_pattern_hash": "8cb32c8386aedd3a6f34609a4f02f539" }, "target_context": { "dst_port": 9042, "service": "cassandra", "service_name": "cassandra", "risk_score": 37 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccep", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccep", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccep", "classification_reason": "Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7e4df39a000b137cbec5cf739f02cccbbc99fd44", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccep", "port": 9042, "service": "cassandra", "service_label_fr": "CASSANDRA" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccep", "attack_vector": "cassandra native \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)", "target_port_label": "9042 \u00b7 CASSANDRA", "emulator_service": "cassandra", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 37\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15, "risk_score": 37 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 37, "risk_label": "Faible", "service_name": "cassandra", "service_label_fr": "CASSANDRA", "dst_port": 9042, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cassandra", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccep", "port": 9042, "service": "cassandra", "service_label_fr": "CASSANDRA" }, "attack_vector": "cassandra native \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9042\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: \/\r\nAccep", "target_port_label": "9042 \u00b7 CASSANDRA", "emulator_service": "cassandra", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cassandra", "service_banner": "honeypot-cassandra", "service_os": "linux", "dst_port": "9042" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "cassandra_emulated", "http_get_probe", "mozi_pattern", "net_cassandra_native" ], "asn_dc_heuristic": true }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

165.232.120.46

Profil de menace

Pourquoi listée

Comparaison ASN / FAI

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence