21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv%252e2
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv%252e2 UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_path_traversal
Cible HTTP
GET
/%252eenv%252e2
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv%252e2
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%252eenv%252e2 HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%252eenv%252e2 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Macintosh; Intel Ma
Requête brute (extrait)
GET /%252eenv%252e2 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept: text/html,application/xhtml+xml,a
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "6bfb9db9793b84d8ad69b8c1551d76767adb4fb3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 466,
"payload_entropy": 5.4994164894722255,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 65,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "00c3faf63579fc1b088440fe3ae8ba8e59799618",
"event_fingerprint": "74e10f4942bb35a3aa2c970c675e0929f6e73cba",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729",
"payload_hash": "c71368f3eefb791513553324d052af27",
"path_pattern_hash": "0d92a501d086d3dc060252c631109181"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%252eenv%252e2 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"method": "GET",
"path": "\/%252eenv%252e2",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252e2 HTTP\/1.1",
"request_sample": "GET \/%252eenv%252e2 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,a",
"payload_snippet": "GET \/%252eenv%252e2 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"evidence": {
"method": "GET",
"path": "\/%252eenv%252e2",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252e2 HTTP\/1.1",
"request_sample": "GET \/%252eenv%252e2 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,a",
"payload_snippet": "GET \/%252eenv%252e2 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d7217817c0b8849f400e3640a57c556b55a0933a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252e2",
"request_line": "GET \/%252eenv%252e2 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv%252e2 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252e2",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252e2",
"request_line": "GET \/%252eenv%252e2 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252e2",
"evidence_snippet": "GET \/%252eenv%252e2 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv%252ebeta
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv%252ebeta UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_path_traversal
Cible HTTP
GET
/%252eenv%252ebeta
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv%252ebeta
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%252eenv%252ebeta HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%252eenv%252ebeta HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Macintosh; Intel
Requête brute (extrait)
GET /%252eenv%252ebeta HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xm
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "cab1d45f3689929dba4b74c9e09de43764115429",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 469,
"payload_entropy": 5.507695681046425,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 65,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "00c3faf63579fc1b088440fe3ae8ba8e59799618",
"event_fingerprint": "ce99d3f8629384d331a0338a19939c572b0ba455",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "28e19718e8682b7b2da889b8120da9bf",
"payload_hash": "df0f3facf63d2bc01376686ea2df6100",
"path_pattern_hash": "66c842a9b3c3e3c82bef579427ceadd1"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%252eenv%252ebeta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"method": "GET",
"path": "\/%252eenv%252ebeta",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252ebeta HTTP\/1.1",
"request_sample": "GET \/%252eenv%252ebeta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xm",
"payload_snippet": "GET \/%252eenv%252ebeta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"evidence": {
"method": "GET",
"path": "\/%252eenv%252ebeta",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252ebeta HTTP\/1.1",
"request_sample": "GET \/%252eenv%252ebeta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xm",
"payload_snippet": "GET \/%252eenv%252ebeta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "09a9cee599a4507cc87079da23b7d794090959a3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252ebeta",
"request_line": "GET \/%252eenv%252ebeta HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv%252ebeta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ebeta",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252ebeta",
"request_line": "GET \/%252eenv%252ebeta HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ebeta",
"evidence_snippet": "GET \/%252eenv%252ebeta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv%252e4
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv%252e4 UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_path_traversal
Cible HTTP
GET
/%252eenv%252e4
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv%252e4
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%252eenv%252e4 HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%252eenv%252e4 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X11; Linux x86_64)
Requête brute (extrait)
GET /%252eenv%252e4 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "9f3cc05986afd07e41d7a89a4d74644778fdb498",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 450,
"payload_entropy": 5.5261612916662255,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 65,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "00c3faf63579fc1b088440fe3ae8ba8e59799618",
"event_fingerprint": "9146e09928b307feb195bf27a9309d586a1a96ae",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278",
"payload_hash": "8128d0b9ed7c35a778a987f909399474",
"path_pattern_hash": "5fc2d59b738ce2885dfdcb49df867c2d"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%252eenv%252e4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) ",
"method": "GET",
"path": "\/%252eenv%252e4",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252e4 HTTP\/1.1",
"request_sample": "GET \/%252eenv%252e4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q",
"payload_snippet": "GET \/%252eenv%252e4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"evidence": {
"method": "GET",
"path": "\/%252eenv%252e4",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252e4 HTTP\/1.1",
"request_sample": "GET \/%252eenv%252e4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q",
"payload_snippet": "GET \/%252eenv%252e4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "baac361bbfe3a9fbf1e98988c43e5307436b5cd7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252e4",
"request_line": "GET \/%252eenv%252e4 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv%252e4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252e4",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252e4",
"request_line": "GET \/%252eenv%252e4 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252e4",
"evidence_snippet": "GET \/%252eenv%252e4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_path_traversal
Cible HTTP
GET
/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%252eenv HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X
Requête brute (extrait)
GET /%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,applica
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "602572890be4ecc5994f5b4792e12cf4b95b4a5e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 460,
"payload_entropy": 5.505994241286866,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 65,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "00c3faf63579fc1b088440fe3ae8ba8e59799618",
"event_fingerprint": "d78cbec4a0033af6a82cb072e5f121b55b235d78",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "28e19718e8682b7b2da889b8120da9bf",
"payload_hash": "b73c8ccb364c60017df72969bb6abaeb",
"path_pattern_hash": "3719eaa71085284ca4f84e736ffb42e2"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X",
"method": "GET",
"path": "\/%252eenv",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv HTTP\/1.1",
"request_sample": "GET \/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applica",
"payload_snippet": "GET \/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X",
"evidence": {
"method": "GET",
"path": "\/%252eenv",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv HTTP\/1.1",
"request_sample": "GET \/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applica",
"payload_snippet": "GET \/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c9a563327d36bafb51783cf68ab9933942f5664e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv",
"request_line": "GET \/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv",
"request_line": "GET \/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv",
"evidence_snippet": "GET \/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv%252e1
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv%252e1 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_path_traversal
Cible HTTP
GET
/%252eenv%252e1
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv%252e1
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%252eenv%252e1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%252eenv%252e1 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi
Requête brute (extrait)
GET /%252eenv%252e1 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,applica
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "7bb7d18d5604dcec65ebf7c89b5dc1fec104dd8c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 460,
"payload_entropy": 5.514830249491959,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 65,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "00c3faf63579fc1b088440fe3ae8ba8e59799618",
"event_fingerprint": "6d1a0e182cc586ee96b59ceee85a2dac52c6763f",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
"payload_hash": "13c0ec3e52a6de46656c9247ff76a70d",
"path_pattern_hash": "dc453e5693fd46b92ee1eef78cf80884"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%252eenv%252e1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"method": "GET",
"path": "\/%252eenv%252e1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252e1 HTTP\/1.1",
"request_sample": "GET \/%252eenv%252e1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applica",
"payload_snippet": "GET \/%252eenv%252e1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"evidence": {
"method": "GET",
"path": "\/%252eenv%252e1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252e1 HTTP\/1.1",
"request_sample": "GET \/%252eenv%252e1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applica",
"payload_snippet": "GET \/%252eenv%252e1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8da5738842eed3904f293ee88cb92fbe7c7e4790",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252e1",
"request_line": "GET \/%252eenv%252e1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv%252e1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252e1",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252e1",
"request_line": "GET \/%252eenv%252e1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252e1",
"evidence_snippet": "GET \/%252eenv%252e1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv%252e3
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv%252e3 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_path_traversal
Cible HTTP
GET
/%252eenv%252e3
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv%252e3
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /%252eenv%252e3 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%252eenv%252e3 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi
Requête brute (extrait)
GET /%252eenv%252e3 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,application/xht
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "9ab0fd604172d72dbb35e3f90e0afbd4d6d4fdde",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 474,
"payload_entropy": 5.5128248366984876,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 65,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "00c3faf63579fc1b088440fe3ae8ba8e59799618",
"event_fingerprint": "0646a506fe000a50d96f9aac8ecd45bd7bdcbf63",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
"payload_hash": "06a24cca89fd986e0f654aa17a97950e",
"path_pattern_hash": "b8c83dfaa0052e3797559a11e2742caa"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%252eenv%252e3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"method": "GET",
"path": "\/%252eenv%252e3",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252e3 HTTP\/1.1",
"request_sample": "GET \/%252eenv%252e3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xht",
"payload_snippet": "GET \/%252eenv%252e3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"evidence": {
"method": "GET",
"path": "\/%252eenv%252e3",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252e3 HTTP\/1.1",
"request_sample": "GET \/%252eenv%252e3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xht",
"payload_snippet": "GET \/%252eenv%252e3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8335a8008dae3a1c80657d55ae11129d5c0ab13a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252e3",
"request_line": "GET \/%252eenv%252e3 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv%252e3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252e3",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252e3",
"request_line": "GET \/%252eenv%252e3 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252e3",
"evidence_snippet": "GET \/%252eenv%252e3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv%252ecustom
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv%252ecustom UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_path_traversal
Cible HTTP
GET
/%252eenv%252ecustom
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv%252ecustom
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%252eenv%252ecustom HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%252eenv%252ecustom HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
GET /%252eenv%252ecustom HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "0e93fa4e6fa7128e3ad4ebc516d37c89c5d44ad6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "af64eb24be2d3a291119dfa1e0d1e024a7902da7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 434,
"payload_entropy": 5.45990634798677,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 65,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "00c3faf63579fc1b088440fe3ae8ba8e59799618",
"event_fingerprint": "dab0ebda274d5af344790b16ff55b0a4bca79306",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "222bb92af5102d5110f0e2e9fad99c71",
"payload_hash": "97243477934b428a275a47913094c4aa",
"path_pattern_hash": "528cab4cf5a4a13211bd98c5d0eb6eba"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%252eenv%252ecustom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"method": "GET",
"path": "\/%252eenv%252ecustom",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252ecustom HTTP\/1.1",
"request_sample": "GET \/%252eenv%252ecustom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,",
"payload_snippet": "GET \/%252eenv%252ecustom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"method": "GET",
"path": "\/%252eenv%252ecustom",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252ecustom HTTP\/1.1",
"request_sample": "GET \/%252eenv%252ecustom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,",
"payload_snippet": "GET \/%252eenv%252ecustom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1f028748d7d645966c6b5baff9ace1fb97896869",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252ecustom",
"request_line": "GET \/%252eenv%252ecustom HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv%252ecustom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ecustom",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252ecustom",
"request_line": "GET \/%252eenv%252ecustom HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ecustom",
"evidence_snippet": "GET \/%252eenv%252ecustom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv%252eazure
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv%252eazure UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_path_traversal
Cible HTTP
GET
/%252eenv%252eazure
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv%252eazure
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%252eenv%252eazure HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%252eenv%252eazure HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0
Requête brute (extrait)
GET /%252eenv%252eazure HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,app
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "46cb7a52e981b4d3e78d3b1ea443b200f90db397",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 464,
"payload_entropy": 5.515362032054337,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 65,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "00c3faf63579fc1b088440fe3ae8ba8e59799618",
"event_fingerprint": "092d9d506cd8695895ca55a67cb58239a0feb4b6",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
"payload_hash": "d102169d330fe358104aa44a0e7f94bc",
"path_pattern_hash": "53c212f8d23ce50180c8a79bb6a63f75"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%252eenv%252eazure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"method": "GET",
"path": "\/%252eenv%252eazure",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252eazure HTTP\/1.1",
"request_sample": "GET \/%252eenv%252eazure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,app",
"payload_snippet": "GET \/%252eenv%252eazure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"evidence": {
"method": "GET",
"path": "\/%252eenv%252eazure",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252eazure HTTP\/1.1",
"request_sample": "GET \/%252eenv%252eazure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,app",
"payload_snippet": "GET \/%252eenv%252eazure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6f4b0aaf6a012759fe7ccbf620600ed74ff468a6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252eazure",
"request_line": "GET \/%252eenv%252eazure HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv%252eazure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252eazure",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252eazure",
"request_line": "GET \/%252eenv%252eazure HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252eazure",
"evidence_snippet": "GET \/%252eenv%252eazure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv%252ebak
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv%252ebak UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
950521:leak-8
Cible HTTP
GET
/%252eenv%252ebak
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv%252ebak
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%252eenv%252ebak HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
leak-8
Payload (extrait)
GET /%252eenv%252ebak HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0;
Requête brute (extrait)
GET /%252eenv%252ebak HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,appli
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "5b70487606088cdade7f2126e0265480e60d1ebf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 462,
"payload_entropy": 5.5192516995383425,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 68,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ba508dea9bd7194bbeb37b80c1748c56fa0de860",
"event_fingerprint": "083e01c17271e31c0d4dbf2648f01d13524c5d4a",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 68
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
"payload_hash": "0adf4121165f6e6a740d4b276f7c0360",
"path_pattern_hash": "efd70b17472158cec26880849bc7f25a"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/%252eenv%252ebak HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; ",
"method": "GET",
"path": "\/%252eenv%252ebak",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/%252eenv%252ebak HTTP\/1.1",
"request_sample": "GET \/%252eenv%252ebak HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appli",
"payload_snippet": "GET \/%252eenv%252ebak HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"evidence": {
"method": "GET",
"path": "\/%252eenv%252ebak",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/%252eenv%252ebak HTTP\/1.1",
"request_sample": "GET \/%252eenv%252ebak HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appli",
"payload_snippet": "GET \/%252eenv%252ebak HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c172d77a05f41a1a49a4466a72a0b48a3ef6e3fd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252ebak",
"request_line": "GET \/%252eenv%252ebak HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv%252ebak HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ebak",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 68
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252ebak",
"request_line": "GET \/%252eenv%252ebak HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ebak",
"evidence_snippet": "GET \/%252eenv%252ebak HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv%252eaws
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv%252eaws UA Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_path_traversal
Cible HTTP
GET
/%252eenv%252eaws
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv%252eaws
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%252eenv%252eaws HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%252eenv%252eaws HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Linux; Android 14
Requête brute (extrait)
GET /%252eenv%252eaws HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Accept: text/html,application/xhtml+xm
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "5a0a178befc917c551427e78d37831bf4cb29a20",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 469,
"payload_entropy": 5.521968977638733,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 65,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "00c3faf63579fc1b088440fe3ae8ba8e59799618",
"event_fingerprint": "bfcbcb37e24eb07b77b4f01f55ad585ff171ba50",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b6437c44634b78992a7fb87fd879dbec",
"payload_hash": "033a087a9e9f53c289b889dfbc7b64c0",
"path_pattern_hash": "0846117ae98039f8a35291293806e356"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%252eenv%252eaws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14",
"method": "GET",
"path": "\/%252eenv%252eaws",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252eaws HTTP\/1.1",
"request_sample": "GET \/%252eenv%252eaws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xm",
"payload_snippet": "GET \/%252eenv%252eaws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14",
"evidence": {
"method": "GET",
"path": "\/%252eenv%252eaws",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252eaws HTTP\/1.1",
"request_sample": "GET \/%252eenv%252eaws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xm",
"payload_snippet": "GET \/%252eenv%252eaws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e300e04b3031a94e4306de9a66a3f264e09e5d43",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252eaws",
"request_line": "GET \/%252eenv%252eaws HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv%252eaws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252eaws",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252eaws",
"request_line": "GET \/%252eenv%252eaws HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252eaws",
"evidence_snippet": "GET \/%252eenv%252eaws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit)
Élevée
Moyen · 58
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9222
Chemin / cible
/
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_
Requête brute (extrait)
POST / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Length: 22 Accept: text/html,application/xhtm
Meta JSON brut
{
"http_header_count": 10,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 544,
"payload_entropy": 5.563021091035954,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 58,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8c9ae988b8829cac8876a5295f6ae065bf893b14",
"event_fingerprint": "d7016bb633e768214a5236aed113279138855b6b",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "28e19718e8682b7b2da889b8120da9bf",
"payload_hash": "99e97635ef5674ceb43a05d8c96a39e4",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nContent-Length: 22\r\nAccept: text\/html,application\/xhtm",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nContent-Length: 22\r\nAccept: text\/html,application\/xhtm",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "928c4e2b2af16b89c99b6f2a85c56c15fefa2e59",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit)",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%00.env.build
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00.env.build UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00.env.build
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%00.env.build
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%00.env.build HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00.env.build HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X11; Linux x86_64) A
Requête brute (extrait)
GET /%00.env.build HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "build",
"http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "d89f2dd444c598257352929e3ab03725a2008cd0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 449,
"payload_entropy": 5.516580818359857,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 65,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9326d42310e37c84ab14d4cac7d8170cc0053235",
"event_fingerprint": "86c4089a32d1a6ec1a84bdc71c0efed0edfd0110",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278",
"payload_hash": "cc315271938f2d4d792ae6c5d019b044",
"path_pattern_hash": "5b32edf13937001dc5c87076ae96d6a4"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%00.env.build HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"method": "GET",
"path": "\/%00.env.build",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.build HTTP\/1.1",
"request_sample": "GET \/%00.env.build HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=",
"payload_snippet": "GET \/%00.env.build HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"evidence": {
"method": "GET",
"path": "\/%00.env.build",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.build HTTP\/1.1",
"request_sample": "GET \/%00.env.build HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=",
"payload_snippet": "GET \/%00.env.build HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1982c734b41447f744dfa346f3ea03ac24e55a70",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.build",
"request_line": "GET \/%00.env.build HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00.env.build HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.build",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.build",
"request_line": "GET \/%00.env.build HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.build",
"evidence_snippet": "GET \/%00.env.build HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv%252econtracts
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv%252econtracts UA Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefo…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_path_traversal
Cible HTTP
GET
/%252eenv%252econtracts
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv%252econtracts
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%252eenv%252econtracts HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%252eenv%252econtracts HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X11; Linux
Requête brute (extrait)
GET /%252eenv%252econtracts HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/a
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "a9efe9b9487b4ef01d6e066714958fac2a9c1ab6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 427,
"payload_entropy": 5.453366492521204,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 65,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "00c3faf63579fc1b088440fe3ae8ba8e59799618",
"event_fingerprint": "af4a39b3723e1094ad2d0320b213a40895ed150a",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
"payload_hash": "01109b2d0337f3a3365340a8d167f0a1",
"path_pattern_hash": "c1b4b19c3f07a7b3a3b36f90664dfce4"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%252eenv%252econtracts HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux ",
"method": "GET",
"path": "\/%252eenv%252econtracts",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252econtracts HTTP\/1.1",
"request_sample": "GET \/%252eenv%252econtracts HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/a",
"payload_snippet": "GET \/%252eenv%252econtracts HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"evidence": {
"method": "GET",
"path": "\/%252eenv%252econtracts",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252econtracts HTTP\/1.1",
"request_sample": "GET \/%252eenv%252econtracts HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/a",
"payload_snippet": "GET \/%252eenv%252econtracts HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ec656c2e07a3c5ca2dc3d25c017cd0a895e597e7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252econtracts",
"request_line": "GET \/%252eenv%252econtracts HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv%252econtracts HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252econtracts",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252econtracts",
"request_line": "GET \/%252eenv%252econtracts HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252econtracts",
"evidence_snippet": "GET \/%252eenv%252econtracts HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv%252ebkp
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv%252ebkp UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_path_traversal
Cible HTTP
GET
/%252eenv%252ebkp
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv%252ebkp
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%252eenv%252ebkp HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%252eenv%252ebkp HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Macintosh; Intel
Requête brute (extrait)
GET /%252eenv%252ebkp HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept: text/html,application/xhtml+xml
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "c40e28dccb163b1339728c3a3532c4efd200349a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 468,
"payload_entropy": 5.505269665943124,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 65,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "00c3faf63579fc1b088440fe3ae8ba8e59799618",
"event_fingerprint": "5c8bebdaf787ef161cda2277c01d854bbf406ee5",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729",
"payload_hash": "a30baef3c339c9af370bfdf1349d68b5",
"path_pattern_hash": "a22d3045fe7f20fecb32decca8247302"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%252eenv%252ebkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel ",
"method": "GET",
"path": "\/%252eenv%252ebkp",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252ebkp HTTP\/1.1",
"request_sample": "GET \/%252eenv%252ebkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/%252eenv%252ebkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"evidence": {
"method": "GET",
"path": "\/%252eenv%252ebkp",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252ebkp HTTP\/1.1",
"request_sample": "GET \/%252eenv%252ebkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/%252eenv%252ebkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f2dda2f1002e19e626323517198555a9adc7cd6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252ebkp",
"request_line": "GET \/%252eenv%252ebkp HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv%252ebkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ebkp",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252ebkp",
"request_line": "GET \/%252eenv%252ebkp HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ebkp",
"evidence_snippet": "GET \/%252eenv%252ebkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv%252ecredentials
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv%252ecredentials UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_path_traversal
Cible HTTP
GET
/%252eenv%252ecredentials
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv%252ecredentials
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%252eenv%252ecredentials HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%252eenv%252ecredentials HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows N
Requête brute (extrait)
GET /%252eenv%252ecredentials HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+x
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "8292d5779f0215f39f79905c92b57dd3c2e1cc4a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 470,
"payload_entropy": 5.498366159274119,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 65,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "00c3faf63579fc1b088440fe3ae8ba8e59799618",
"event_fingerprint": "0f8fb3fde5314bc5ea087c59cf501cc596f9eaf1",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
"payload_hash": "2272099aff25e6dc583b66f3e516d3c6",
"path_pattern_hash": "827d28171775ae1bbfc0f1018e82272a"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%252eenv%252ecredentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows N",
"method": "GET",
"path": "\/%252eenv%252ecredentials",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252ecredentials HTTP\/1.1",
"request_sample": "GET \/%252eenv%252ecredentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+x",
"payload_snippet": "GET \/%252eenv%252ecredentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows N",
"evidence": {
"method": "GET",
"path": "\/%252eenv%252ecredentials",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252ecredentials HTTP\/1.1",
"request_sample": "GET \/%252eenv%252ecredentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+x",
"payload_snippet": "GET \/%252eenv%252ecredentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows N",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "99726fe517325c3f7790aa0288425f5da35628a0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252ecredentials",
"request_line": "GET \/%252eenv%252ecredentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv%252ecredentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows N",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ecredentials",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252ecredentials",
"request_line": "GET \/%252eenv%252ecredentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ecredentials",
"evidence_snippet": "GET \/%252eenv%252ecredentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows N",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%63%72%65%64%73
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%63%72%65%64%73 UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%63%72%65%64%73
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%63%72%65%64%73
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.%65%6e%76.%63%72%65%64%73?v=3jSTw HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%63%72%65%64%73?v=3jSTw HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0
Requête brute (extrait)
GET /.%65%6e%76.%63%72%65%64%73?v=3jSTw HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,app
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%63%72%65%64%73",
"http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "a91fc12590e9212a17c6fa2d88afbd1670b33312",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 486,
"payload_entropy": 5.58648562943115,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "dcc1304e9820dd67d52828124c5ce4ab20d24f8b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "28e19718e8682b7b2da889b8120da9bf",
"payload_hash": "0b811315e00c99e88160e04b1b27dfa0",
"path_pattern_hash": "0ad51c49ff753d173ed4e40a6a4dbe70"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%63%72%65%64%73?v=3jSTw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 ",
"method": "GET",
"path": "\/.%65%6e%76.%63%72%65%64%73",
"query_string": "v=3jSTw",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%63%72%65%64%73?v=3jSTw HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%63%72%65%64%73?v=3jSTw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,app",
"payload_snippet": "GET \/.%65%6e%76.%63%72%65%64%73?v=3jSTw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%63%72%65%64%73",
"query_string": "v=3jSTw",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%63%72%65%64%73?v=3jSTw HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%63%72%65%64%73?v=3jSTw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,app",
"payload_snippet": "GET \/.%65%6e%76.%63%72%65%64%73?v=3jSTw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c375f3370132ebe3d7942395c10edadd82dd96b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%63%72%65%64%73",
"request_line": "GET \/.%65%6e%76.%63%72%65%64%73?v=3jSTw HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%63%72%65%64%73?v=3jSTw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%63%72%65%64%73",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%63%72%65%64%73",
"request_line": "GET \/.%65%6e%76.%63%72%65%64%73?v=3jSTw HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%63%72%65%64%73",
"evidence_snippet": "GET \/.%65%6e%76.%63%72%65%64%73?v=3jSTw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv%252ecopy
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv%252ecopy UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_path_traversal
Cible HTTP
GET
/%252eenv%252ecopy
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv%252ecopy
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /%252eenv%252ecopy HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%252eenv%252ecopy HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (iPhone; CPU iPho
Requête brute (extrait)
GET /%252eenv%252ecopy HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Accept: text/html
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "74019f29ca873f03631d54483b254e143b71a75c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 490,
"payload_entropy": 5.511130116191283,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 65,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "00c3faf63579fc1b088440fe3ae8ba8e59799618",
"event_fingerprint": "6f8589938e1669ce3adfdb9da3f2cc1baba5e677",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c",
"payload_hash": "4d74a4b236a0fb85cfbabc1868f5db66",
"path_pattern_hash": "6c251d639668fc57452d341772e074b2"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%252eenv%252ecopy HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPho",
"method": "GET",
"path": "\/%252eenv%252ecopy",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252ecopy HTTP\/1.1",
"request_sample": "GET \/%252eenv%252ecopy HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html",
"payload_snippet": "GET \/%252eenv%252ecopy HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPho",
"evidence": {
"method": "GET",
"path": "\/%252eenv%252ecopy",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252ecopy HTTP\/1.1",
"request_sample": "GET \/%252eenv%252ecopy HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html",
"payload_snippet": "GET \/%252eenv%252ecopy HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPho",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5652005b12d21bcec5984c5f6a5ca4500367cb01",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252ecopy",
"request_line": "GET \/%252eenv%252ecopy HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv%252ecopy HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPho",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ecopy",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252ecopy",
"request_line": "GET \/%252eenv%252ecopy HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ecopy",
"evidence_snippet": "GET \/%252eenv%252ecopy HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPho",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv%252eci
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv%252eci UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_path_traversal
Cible HTTP
GET
/%252eenv%252eci
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv%252eci
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%252eenv%252eci HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%252eenv%252eci HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
GET /%252eenv%252eci HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,imag
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "0e93fa4e6fa7128e3ad4ebc516d37c89c5d44ad6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "8297df9b914a4ad03da525e4070c37444c62cb0e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 430,
"payload_entropy": 5.458027477449405,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 65,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "00c3faf63579fc1b088440fe3ae8ba8e59799618",
"event_fingerprint": "34836f46522d29d08a40995bcaa145dc80542638",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "222bb92af5102d5110f0e2e9fad99c71",
"payload_hash": "953cb8df3d7526953436a79b55c4e6a2",
"path_pattern_hash": "b214f087b9f2d8ec8ab3b4c29408b863"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%252eenv%252eci HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"method": "GET",
"path": "\/%252eenv%252eci",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252eci HTTP\/1.1",
"request_sample": "GET \/%252eenv%252eci HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,imag",
"payload_snippet": "GET \/%252eenv%252eci HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"method": "GET",
"path": "\/%252eenv%252eci",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252eci HTTP\/1.1",
"request_sample": "GET \/%252eenv%252eci HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,imag",
"payload_snippet": "GET \/%252eenv%252eci HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "44c78b5468fb51cf29599f175ff14045a0d1c34b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252eci",
"request_line": "GET \/%252eenv%252eci HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv%252eci HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252eci",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252eci",
"request_line": "GET \/%252eenv%252eci HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252eci",
"evidence_snippet": "GET \/%252eenv%252eci HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:25 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%252eenv%252e0
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%252eenv%252e0 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_path_traversal
Cible HTTP
GET
/%252eenv%252e0
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%252eenv%252e0
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%252eenv%252e0 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%252eenv%252e0 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi
Requête brute (extrait)
GET /%252eenv%252e0 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "0e93fa4e6fa7128e3ad4ebc516d37c89c5d44ad6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "f093ef84f83887d5dce53a567e1835924ccdee0d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 429,
"payload_entropy": 5.45932420996606,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 65,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "00c3faf63579fc1b088440fe3ae8ba8e59799618",
"event_fingerprint": "0b36814591a16ea5e1e310da75f9a505b1de6239",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "222bb92af5102d5110f0e2e9fad99c71",
"payload_hash": "0b543047ec9f5f52a6b492aa253e0f4c",
"path_pattern_hash": "0d9bb343dbaff2bdb52727f3a34113cf"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%252eenv%252e0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"method": "GET",
"path": "\/%252eenv%252e0",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252e0 HTTP\/1.1",
"request_sample": "GET \/%252eenv%252e0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image",
"payload_snippet": "GET \/%252eenv%252e0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"evidence": {
"method": "GET",
"path": "\/%252eenv%252e0",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%252eenv%252e0 HTTP\/1.1",
"request_sample": "GET \/%252eenv%252e0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image",
"payload_snippet": "GET \/%252eenv%252e0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1f711c804cf47907fe6338b55f44ca5048104b4c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252e0",
"request_line": "GET \/%252eenv%252e0 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%252eenv%252e0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252e0",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%252eenv%252e0",
"request_line": "GET \/%252eenv%252e0 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252e0",
"evidence_snippet": "GET \/%252eenv%252e0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%62%61%63%6b%75%70
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%62%61%63%6b%75%70 UA Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%62%61%63%6b%75%70
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%62%61%63%6b%75%70
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.%65%6e%76.%62%61%63%6b%75%70?v=tdaFV HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%62%61%63%6b%75%70?v=tdaFV HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5
Requête brute (extrait)
GET /.%65%6e%76.%62%61%63%6b%75%70?v=tdaFV HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Accept: text/html
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%62%61%63%6b%75%70",
"http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "a73a8d4b3cf651160a12587b7bd34a29fb2ff2c9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 490,
"payload_entropy": 5.592412463964318,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "9116e19853f5e8ecaa983a87fefdabec49f00481",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b6437c44634b78992a7fb87fd879dbec",
"payload_hash": "a193dc91f963a61fe9655ddcb69ab818",
"path_pattern_hash": "eda4b4090651a5865217febbe010524b"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%62%61%63%6b%75%70?v=tdaFV HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5",
"method": "GET",
"path": "\/.%65%6e%76.%62%61%63%6b%75%70",
"query_string": "v=tdaFV",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%62%61%63%6b%75%70?v=tdaFV HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%62%61%63%6b%75%70?v=tdaFV HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html",
"payload_snippet": "GET \/.%65%6e%76.%62%61%63%6b%75%70?v=tdaFV HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%62%61%63%6b%75%70",
"query_string": "v=tdaFV",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%62%61%63%6b%75%70?v=tdaFV HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%62%61%63%6b%75%70?v=tdaFV HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html",
"payload_snippet": "GET \/.%65%6e%76.%62%61%63%6b%75%70?v=tdaFV HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fcbee96ffb9dba9d1c9a6e284f831da738ee8bb7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%62%61%63%6b%75%70",
"request_line": "GET \/.%65%6e%76.%62%61%63%6b%75%70?v=tdaFV HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%62%61%63%6b%75%70?v=tdaFV HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%62%61%63%6b%75%70",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%62%61%63%6b%75%70",
"request_line": "GET \/.%65%6e%76.%62%61%63%6b%75%70?v=tdaFV HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%62%61%63%6b%75%70",
"evidence_snippet": "GET \/.%65%6e%76.%62%61%63%6b%75%70?v=tdaFV HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73 UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73?v=Li3a3 HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73?v=Li3a3 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-A
Requête brute (extrait)
GET /.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73?v=Li3a3 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Acc
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%63%72%65%64%65%6e%74%69%61%6c%73",
"http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "e68857f89ee3c0a58f19b17d38263b0b834efa24",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 504,
"payload_entropy": 5.572084150945314,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "bd16bede08130799ad0d89410db5bf77c820d149",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729",
"payload_hash": "cefd4fdd641c66dd78ee80aa082b0cd3",
"path_pattern_hash": "4da0acfe58f5be10ee8f9df7ec0b4eb3"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73?v=Li3a3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-A",
"method": "GET",
"path": "\/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73",
"query_string": "v=Li3a3",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73?v=Li3a3 HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73?v=Li3a3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAcc",
"payload_snippet": "GET \/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73?v=Li3a3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-A",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73",
"query_string": "v=Li3a3",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73?v=Li3a3 HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73?v=Li3a3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAcc",
"payload_snippet": "GET \/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73?v=Li3a3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-A",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e8b2234294397d96b89a73ade2d8ce30c488eabf",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73",
"request_line": "GET \/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73?v=Li3a3 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73?v=Li3a3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-A",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73",
"request_line": "GET \/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73?v=Li3a3 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73",
"evidence_snippet": "GET \/.%65%6e%76.%63%72%65%64%65%6e%74%69%61%6c%73?v=Li3a3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-A",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%35
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%35 UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%35
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%35
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.%65%6e%76.%35?v=68U1A HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%35?v=68U1A HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Macintosh;
Requête brute (extrait)
GET /.%65%6e%76.%35?v=68U1A HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept: text/html,application/xht
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%35",
"http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "9ff0dee5a9029a5944d3423bb1f64945bbb48cab",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 474,
"payload_entropy": 5.547884007588566,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "d1ab990fe9e5b530577ae80d8d92fd612153b5bc",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729",
"payload_hash": "a1328baf7e3b76bbabf775a9d83e3c62",
"path_pattern_hash": "375b28f432978b8ef01df659aea6e82b"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%35?v=68U1A HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; ",
"method": "GET",
"path": "\/.%65%6e%76.%35",
"query_string": "v=68U1A",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%35?v=68U1A HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%35?v=68U1A HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xht",
"payload_snippet": "GET \/.%65%6e%76.%35?v=68U1A HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%35",
"query_string": "v=68U1A",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%35?v=68U1A HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%35?v=68U1A HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xht",
"payload_snippet": "GET \/.%65%6e%76.%35?v=68U1A HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f9f1a9e37f4fe84fbb345b23a4150a074a35540b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%35",
"request_line": "GET \/.%65%6e%76.%35?v=68U1A HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%35?v=68U1A HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%35",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%35",
"request_line": "GET \/.%65%6e%76.%35?v=68U1A HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%35",
"evidence_snippet": "GET \/.%65%6e%76.%35?v=68U1A HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%31
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%31 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%31
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%31
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /.%65%6e%76.%31?v=XMsvE HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%31?v=XMsvE HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT
Requête brute (extrait)
GET /.%65%6e%76.%31?v=XMsvE HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%31",
"http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "57dd8bd34b47920247540e3a4b59257dd4cc8968",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 468,
"payload_entropy": 5.562147493342329,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "6a53f6be93aee5f5923e267ffa688450d1669fb3",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
"payload_hash": "a625c0365608eba797d56486127537e1",
"path_pattern_hash": "74edfb1f78337000e7cbd69629312208"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%31?v=XMsvE HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT ",
"method": "GET",
"path": "\/.%65%6e%76.%31",
"query_string": "v=XMsvE",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%31?v=XMsvE HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%31?v=XMsvE HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/.%65%6e%76.%31?v=XMsvE HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%31",
"query_string": "v=XMsvE",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%31?v=XMsvE HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%31?v=XMsvE HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/.%65%6e%76.%31?v=XMsvE HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e05d609adb486912e7a3b19df870fe1a50812065",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%31",
"request_line": "GET \/.%65%6e%76.%31?v=XMsvE HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%31?v=XMsvE HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%31",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%31",
"request_line": "GET \/.%65%6e%76.%31?v=XMsvE HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%31",
"evidence_snippet": "GET \/.%65%6e%76.%31?v=XMsvE HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%33
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%33 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%33
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%33
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.%65%6e%76.%33?v=kGNyL HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%33?v=kGNyL HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT
Requête brute (extrait)
GET /.%65%6e%76.%33?v=kGNyL HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,applica
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%33",
"http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "d3c060fe953baaca344f9a3ab47ebac499618c1e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 482,
"payload_entropy": 5.560915640728425,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "571659f41b7a898d987dc010b28c5941eaf22b99",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
"payload_hash": "55e64b87ec3640be37b385d0a7537cb2",
"path_pattern_hash": "5902dc6ca69e452f4ae2ba8f7c698830"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%33?v=kGNyL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT ",
"method": "GET",
"path": "\/.%65%6e%76.%33",
"query_string": "v=kGNyL",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%33?v=kGNyL HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%33?v=kGNyL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,applica",
"payload_snippet": "GET \/.%65%6e%76.%33?v=kGNyL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%33",
"query_string": "v=kGNyL",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%33?v=kGNyL HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%33?v=kGNyL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,applica",
"payload_snippet": "GET \/.%65%6e%76.%33?v=kGNyL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b4234178d26cce4fc5aa56237b0c3db74ec08d81",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%33",
"request_line": "GET \/.%65%6e%76.%33?v=kGNyL HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%33?v=kGNyL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%33",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%33",
"request_line": "GET \/.%65%6e%76.%33?v=kGNyL HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%33",
"evidence_snippet": "GET \/.%65%6e%76.%33?v=kGNyL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9222 · (tentative d'exploit)
Élevée
Moyen · 57
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefo…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9222
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 57
Confiance : Confiance 95 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 941130
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gec
Requête brute (extrait)
POST / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Content-Length: 14 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/ap
Meta JSON brut
{
"http_header_count": 10,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 489,
"payload_entropy": 5.479026189932389,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 72,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 72,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 57,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8c9ae988b8829cac8876a5295f6ae065bf893b14",
"event_fingerprint": "d7016bb633e768214a5236aed113279138855b6b",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0284"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 941130"
],
"pattern_ids": [
"pat-0842",
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
"payload_hash": "bac4c8d9b3638365825c0adf16dd685b",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gec",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nContent-Length: 14\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/ap",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gec",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nContent-Length: 14\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/ap",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gec",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "62da78dc297ac744799830d58365853dda526ff1",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gec",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit)",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 72,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gec",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /%61%6e%61%6c%79%74%69%63%73/.%65%6e%76
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /%61%6e%61%6c%79%74%69%63%73/.%65%6e%76 UA Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%61%6e%61%6c%79%74%69%63%73/.%65%6e%76
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%61%6e%61%6c%79%74%69%63%73/.%65%6e%76
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /%61%6e%61%6c%79%74%69%63%73/.%65%6e%76?v=YxyIw HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%61%6e%61%6c%79%74%69%63%73/.%65%6e%76?v=YxyIw HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent:
Requête brute (extrait)
GET /%61%6e%61%6c%79%74%69%63%73/.%65%6e%76?v=YxyIw HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Accept:
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": "%65%6e%76",
"http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "5dae2f407a88607734923e84a4f1d5ad74584240",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 499,
"payload_entropy": 5.602873858113188,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 67,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "8dd934ff466585323ea4501bd042c7fa10d912d3",
"event_fingerprint": "7fb3beb1a8165f556e72dda1d21982a0edfab7a6",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 67
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b6437c44634b78992a7fb87fd879dbec",
"payload_hash": "291afce35b30d1bb7d049f25599ea9f8",
"path_pattern_hash": "487d67e403b605c1c9dfcd9751fec205"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76?v=YxyIw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: ",
"method": "GET",
"path": "\/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76",
"query_string": "v=YxyIw",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76?v=YxyIw HTTP\/1.1",
"request_sample": "GET \/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76?v=YxyIw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: ",
"payload_snippet": "GET \/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76?v=YxyIw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76",
"query_string": "v=YxyIw",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76?v=YxyIw HTTP\/1.1",
"request_sample": "GET \/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76?v=YxyIw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: ",
"payload_snippet": "GET \/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76?v=YxyIw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent:",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aae265fbded88b6c7ea909027a6c367385728e78",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76",
"request_line": "GET \/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76?v=YxyIw HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76?v=YxyIw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent:",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 67
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76",
"request_line": "GET \/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76?v=YxyIw HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76",
"evidence_snippet": "GET \/%61%6e%61%6c%79%74%69%63%73\/.%65%6e%76?v=YxyIw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent:",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%62%6b%70
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%62%6b%70 UA Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) App…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%62%6b%70
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%62%6b%70
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.%65%6e%76.%62%6b%70?v=G9ECv HTTP/1.1
User-Agent
Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%62%6b%70?v=G9ECv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozlila/5.0 (Linux
Requête brute (extrait)
GET /.%65%6e%76.%62%6b%70?v=G9ECv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%62%6b%70",
"http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "df3ecf47a2816887fce63ba0f390e116125ddecb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 515,
"payload_entropy": 5.614937313884957,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "f5c91c512ba6a3a5ca582eedab495031a5c8d611",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9219a56a94233bae47f378d01e805eeb",
"payload_hash": "cf59589abd90f91be995c39f4bb99a72",
"path_pattern_hash": "4586e26e9a111e82c21e6cba0a654065"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%62%6b%70?v=G9ECv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux",
"method": "GET",
"path": "\/.%65%6e%76.%62%6b%70",
"query_string": "v=G9ECv",
"user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%62%6b%70?v=G9ECv HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%62%6b%70?v=G9ECv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/",
"payload_snippet": "GET \/.%65%6e%76.%62%6b%70?v=G9ECv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%62%6b%70",
"query_string": "v=G9ECv",
"user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%62%6b%70?v=G9ECv HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%62%6b%70?v=G9ECv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/",
"payload_snippet": "GET \/.%65%6e%76.%62%6b%70?v=G9ECv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "071e1f18d3e6df4d6023e06d7dfc736789729cea",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%62%6b%70",
"request_line": "GET \/.%65%6e%76.%62%6b%70?v=G9ECv HTTP\/1.1",
"http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%62%6b%70?v=G9ECv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%62%6b%70",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%62%6b%70",
"request_line": "GET \/.%65%6e%76.%62%6b%70?v=G9ECv HTTP\/1.1",
"http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%62%6b%70",
"evidence_snippet": "GET \/.%65%6e%76.%62%6b%70?v=G9ECv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%62%65%74%61
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%62%65%74%61 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%62%65%74%61
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%62%65%74%61
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.%65%6e%76.%62%65%74%61?v=cAQQd HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%62%65%74%61?v=cAQQd HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Wi
Requête brute (extrait)
GET /.%65%6e%76.%62%65%74%61?v=cAQQd HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/htm
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%62%65%74%61",
"http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "07680befff951953833ab014791a76ba1a6dcbf2",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 491,
"payload_entropy": 5.573786770643212,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "2feb9d704b106e399e16a3ef021294be887e5d79",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
"payload_hash": "36f9122a884c4baa501d4d132b07a550",
"path_pattern_hash": "63ecc80c9f2c29263bea51953c54cf99"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%62%65%74%61?v=cAQQd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Wi",
"method": "GET",
"path": "\/.%65%6e%76.%62%65%74%61",
"query_string": "v=cAQQd",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%62%65%74%61?v=cAQQd HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%62%65%74%61?v=cAQQd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/htm",
"payload_snippet": "GET \/.%65%6e%76.%62%65%74%61?v=cAQQd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Wi",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%62%65%74%61",
"query_string": "v=cAQQd",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%62%65%74%61?v=cAQQd HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%62%65%74%61?v=cAQQd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/htm",
"payload_snippet": "GET \/.%65%6e%76.%62%65%74%61?v=cAQQd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Wi",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9b18563ea579191fd05b6d4150b66caab312597d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%62%65%74%61",
"request_line": "GET \/.%65%6e%76.%62%65%74%61?v=cAQQd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%62%65%74%61?v=cAQQd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Wi",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%62%65%74%61",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%62%65%74%61",
"request_line": "GET \/.%65%6e%76.%62%65%74%61?v=cAQQd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%62%65%74%61",
"evidence_snippet": "GET \/.%65%6e%76.%62%65%74%61?v=cAQQd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Wi",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%61%77%73
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%61%77%73 UA Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefo…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%61%77%73
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%61%77%73
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /.%65%6e%76.%61%77%73?v=tZtRH HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%61%77%73?v=tZtRH HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X11;
Requête brute (extrait)
GET /.%65%6e%76.%61%77%73?v=tZtRH HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,i
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%61%77%73",
"http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "a20fbbf501a28282923f1123339bf9c7a3dddc70",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 433,
"payload_entropy": 5.5440576309043825,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "53343e0d046f523b71c0ac2855d01cd21d7eb2cf",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
"payload_hash": "5c139daa02711330ad330303087dd2da",
"path_pattern_hash": "0a08d22df2c3f1ac0df14873836e13c9"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%61%77%73?v=tZtRH HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; ",
"method": "GET",
"path": "\/.%65%6e%76.%61%77%73",
"query_string": "v=tZtRH",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%61%77%73?v=tZtRH HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%61%77%73?v=tZtRH HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,i",
"payload_snippet": "GET \/.%65%6e%76.%61%77%73?v=tZtRH HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11;",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%61%77%73",
"query_string": "v=tZtRH",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%61%77%73?v=tZtRH HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%61%77%73?v=tZtRH HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,i",
"payload_snippet": "GET \/.%65%6e%76.%61%77%73?v=tZtRH HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11;",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1be404eb33f367573895cc76eedcd92fb939beda",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%61%77%73",
"request_line": "GET \/.%65%6e%76.%61%77%73?v=tZtRH HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%61%77%73?v=tZtRH HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11;",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%61%77%73",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%61%77%73",
"request_line": "GET \/.%65%6e%76.%61%77%73?v=tZtRH HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%61%77%73",
"evidence_snippet": "GET \/.%65%6e%76.%61%77%73?v=tZtRH HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11;",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%63%69
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%63%69 UA Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) App…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%63%69
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%63%69
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.%65%6e%76.%63%69?v=zJjhf HTTP/1.1
User-Agent
Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%63%69?v=zJjhf HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozlila/5.0 (Linux; A
Requête brute (extrait)
GET /.%65%6e%76.%63%69?v=zJjhf HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%63%69",
"http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "4f95f99dd59a0306404d1bbe3fb44a5429530ca4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 512,
"payload_entropy": 5.625209237074179,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "b146b915b0892c7eef83509c4956939522039613",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9219a56a94233bae47f378d01e805eeb",
"payload_hash": "0927eb99b17c4fea03dab59e6391e174",
"path_pattern_hash": "ae4daec557616fe74d87cff39aab7224"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%63%69?v=zJjhf HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; A",
"method": "GET",
"path": "\/.%65%6e%76.%63%69",
"query_string": "v=zJjhf",
"user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%63%69?v=zJjhf HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%63%69?v=zJjhf HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537",
"payload_snippet": "GET \/.%65%6e%76.%63%69?v=zJjhf HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; A",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%63%69",
"query_string": "v=zJjhf",
"user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%63%69?v=zJjhf HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%63%69?v=zJjhf HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537",
"payload_snippet": "GET \/.%65%6e%76.%63%69?v=zJjhf HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; A",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "defa12df995e97fe308f507d5afc180eaa0a7eb2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%63%69",
"request_line": "GET \/.%65%6e%76.%63%69?v=zJjhf HTTP\/1.1",
"http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%63%69?v=zJjhf HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; A",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%63%69",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%63%69",
"request_line": "GET \/.%65%6e%76.%63%69?v=zJjhf HTTP\/1.1",
"http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%63%69",
"evidence_snippet": "GET \/.%65%6e%76.%63%69?v=zJjhf HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; A",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.%65%6e%76?v=vgiL9 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76?v=vgiL9 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0
Requête brute (extrait)
GET /.%65%6e%76?v=vgiL9 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,application
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%65%6e%76",
"http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "fcbfb09eea5ab66735c8319acc233ebcfbce7f02",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 478,
"payload_entropy": 5.5440588375484205,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 65,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "fb414a36964d5cf47dd1d503eb3af2fc4d77d93b",
"event_fingerprint": "a050976029fbd2691b409c53bbb87b9255c59849",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 65
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
"payload_hash": "bfa88429f05dc05004d1ada89bf6e084",
"path_pattern_hash": "9e1d0dff23923a351b293be1ba6d6036"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/.%65%6e%76?v=vgiL9 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"method": "GET",
"path": "\/.%65%6e%76",
"query_string": "v=vgiL9",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76?v=vgiL9 HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76?v=vgiL9 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application",
"payload_snippet": "GET \/.%65%6e%76?v=vgiL9 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76",
"query_string": "v=vgiL9",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76?v=vgiL9 HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76?v=vgiL9 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application",
"payload_snippet": "GET \/.%65%6e%76?v=vgiL9 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ac2cdeb157162338eba608e46e4e946c7bb24f9a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76",
"request_line": "GET \/.%65%6e%76?v=vgiL9 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76?v=vgiL9 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76",
"request_line": "GET \/.%65%6e%76?v=vgiL9 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76",
"evidence_snippet": "GET \/.%65%6e%76?v=vgiL9 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_env",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%34
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%34 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%34
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%34
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.%65%6e%76.%34?v=Wnkng HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%34?v=Wnkng HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT
Requête brute (extrait)
GET /.%65%6e%76.%34?v=Wnkng HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,applica
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%34",
"http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "6f544e50dac83810cccab3b5f462ebf0f0e5556a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 482,
"payload_entropy": 5.543621989705551,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "7df63bee5c83bd328b746aa5d47006bcb960340b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
"payload_hash": "e515390863ce0729661facf2cac80b59",
"path_pattern_hash": "518e243d7f4b284e7f15f6cecdd37fe8"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%34?v=Wnkng HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT ",
"method": "GET",
"path": "\/.%65%6e%76.%34",
"query_string": "v=Wnkng",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%34?v=Wnkng HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%34?v=Wnkng HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,applica",
"payload_snippet": "GET \/.%65%6e%76.%34?v=Wnkng HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%34",
"query_string": "v=Wnkng",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%34?v=Wnkng HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%34?v=Wnkng HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,applica",
"payload_snippet": "GET \/.%65%6e%76.%34?v=Wnkng HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "39fe57fcb045500fd92a5e184349e49860eed857",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%34",
"request_line": "GET \/.%65%6e%76.%34?v=Wnkng HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%34?v=Wnkng HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%34",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%34",
"request_line": "GET \/.%65%6e%76.%34?v=Wnkng HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%34",
"evidence_snippet": "GET \/.%65%6e%76.%34?v=Wnkng HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%61%7a%75%72%65
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%61%7a%75%72%65 UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%61%7a%75%72%65
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%61%7a%75%72%65
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.%65%6e%76.%61%7a%75%72%65?v=kEjgJ HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%61%7a%75%72%65?v=kEjgJ HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0
Requête brute (extrait)
GET /.%65%6e%76.%61%7a%75%72%65?v=kEjgJ HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%61%7a%75%72%65",
"http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "904734d61e730dd46421e7b08ccbcdd570941569",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 507,
"payload_entropy": 5.596131919273363,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "0f3100c356343371d082a92b2dfd27530f1e69b1",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c",
"payload_hash": "bfbfe849472759a83e3c372530de02ca",
"path_pattern_hash": "b783ebd73cd8563ecfbff88bb7347efd"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%61%7a%75%72%65?v=kEjgJ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 ",
"method": "GET",
"path": "\/.%65%6e%76.%61%7a%75%72%65",
"query_string": "v=kEjgJ",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%61%7a%75%72%65?v=kEjgJ HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%61%7a%75%72%65?v=kEjgJ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\n",
"payload_snippet": "GET \/.%65%6e%76.%61%7a%75%72%65?v=kEjgJ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%61%7a%75%72%65",
"query_string": "v=kEjgJ",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%61%7a%75%72%65?v=kEjgJ HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%61%7a%75%72%65?v=kEjgJ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\n",
"payload_snippet": "GET \/.%65%6e%76.%61%7a%75%72%65?v=kEjgJ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "10cce52f2a4108b9c19240b0219114616829bc8e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%61%7a%75%72%65",
"request_line": "GET \/.%65%6e%76.%61%7a%75%72%65?v=kEjgJ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%61%7a%75%72%65?v=kEjgJ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%61%7a%75%72%65",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%61%7a%75%72%65",
"request_line": "GET \/.%65%6e%76.%61%7a%75%72%65?v=kEjgJ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%61%7a%75%72%65",
"evidence_snippet": "GET \/.%65%6e%76.%61%7a%75%72%65?v=kEjgJ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%62%61%6b
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%62%61%6b UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
950521:leak-8
Cible HTTP
GET
/.%65%6e%76.%62%61%6b
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%62%61%6b
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /.%65%6e%76.%62%61%6b?v=ufYSn HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
leak-8
Payload (extrait)
GET /.%65%6e%76.%62%61%6b?v=ufYSn HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X11;
Requête brute (extrait)
GET /.%65%6e%76.%62%61%6b?v=ufYSn HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,app
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%62%61%6b",
"http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "0f3cb624c54bafed6f5a5bbad2d105f8609ed37a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 464,
"payload_entropy": 5.579178922797121,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 68,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "2f986a6cea55e1aaa0b17f97ab86db7f13cec36f",
"event_fingerprint": "8bf482418f5b5ba34a0c83669525ae27bf52e692",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 68
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278",
"payload_hash": "b11bef04c74c2f9908caa8cb4a1ae66f",
"path_pattern_hash": "592664d09a1fcb26d74680ecafcb856a"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/.%65%6e%76.%62%61%6b?v=ufYSn HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; ",
"method": "GET",
"path": "\/.%65%6e%76.%62%61%6b",
"query_string": "v=ufYSn",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.%65%6e%76.%62%61%6b?v=ufYSn HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%62%61%6b?v=ufYSn HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,app",
"payload_snippet": "GET \/.%65%6e%76.%62%61%6b?v=ufYSn HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11;",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%62%61%6b",
"query_string": "v=ufYSn",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.%65%6e%76.%62%61%6b?v=ufYSn HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%62%61%6b?v=ufYSn HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,app",
"payload_snippet": "GET \/.%65%6e%76.%62%61%6b?v=ufYSn HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11;",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8ffa3456d20edb0db75f59097052f80b319df13d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%62%61%6b",
"request_line": "GET \/.%65%6e%76.%62%61%6b?v=ufYSn HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%62%61%6b?v=ufYSn HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11;",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%62%61%6b",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 68
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%62%61%6b",
"request_line": "GET \/.%65%6e%76.%62%61%6b?v=ufYSn HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%62%61%6b",
"evidence_snippet": "GET \/.%65%6e%76.%62%61%6b?v=ufYSn HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11;",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"http_backup_file_scan",
"http_backup_path",
"http_probe_env",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%32
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%32 UA Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefo…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%32
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%32
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /.%65%6e%76.%32?v=avmRA HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%32?v=avmRA HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X11; Linux
Requête brute (extrait)
GET /.%65%6e%76.%32?v=avmRA HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/a
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%32",
"http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "2f0688c4df9d60f7793c4218b0b84adc54992500",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 427,
"payload_entropy": 5.518665544452685,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "0122c7a8776a6cc0a20809e4c55e40532e51a0e7",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
"payload_hash": "ea6354b7e3bc063f4cfa95a0e4e1ce47",
"path_pattern_hash": "fa95bb26e7f1835007259aa5f43fe879"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%32?v=avmRA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux ",
"method": "GET",
"path": "\/.%65%6e%76.%32",
"query_string": "v=avmRA",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%32?v=avmRA HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%32?v=avmRA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/a",
"payload_snippet": "GET \/.%65%6e%76.%32?v=avmRA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%32",
"query_string": "v=avmRA",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%32?v=avmRA HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%32?v=avmRA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/a",
"payload_snippet": "GET \/.%65%6e%76.%32?v=avmRA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4ee2a870c1956030ce27c4f73fd3185be81d7bed",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%32",
"request_line": "GET \/.%65%6e%76.%32?v=avmRA HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%32?v=avmRA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%32",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%32",
"request_line": "GET \/.%65%6e%76.%32?v=avmRA HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%32",
"evidence_snippet": "GET \/.%65%6e%76.%32?v=avmRA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%30
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%30 UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%30
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%30
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /.%65%6e%76.%30?v=Ipguo HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%30?v=Ipguo HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X11; Linux
Requête brute (extrait)
GET /.%65%6e%76.%30?v=Ipguo HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%30",
"http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "9cd4b661e6169f9d11e59808b977287bbe71e389",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 458,
"payload_entropy": 5.554363321490658,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "8479821cbe7c072536f59d9d09dfef42748622da",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278",
"payload_hash": "e4e1fa9ef1b905f37f4a3cdb3fba9ec8",
"path_pattern_hash": "76fee2e1879b282e1b8b99d4c20ead92"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%30?v=Ipguo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux ",
"method": "GET",
"path": "\/.%65%6e%76.%30",
"query_string": "v=Ipguo",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%30?v=Ipguo HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%30?v=Ipguo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applicati",
"payload_snippet": "GET \/.%65%6e%76.%30?v=Ipguo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%30",
"query_string": "v=Ipguo",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%30?v=Ipguo HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%30?v=Ipguo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applicati",
"payload_snippet": "GET \/.%65%6e%76.%30?v=Ipguo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b4d7eec60ba063c3c657eda7bd4bfbdfaff1fd38",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%30",
"request_line": "GET \/.%65%6e%76.%30?v=Ipguo HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%30?v=Ipguo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%30",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%30",
"request_line": "GET \/.%65%6e%76.%30?v=Ipguo HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%30",
"evidence_snippet": "GET \/.%65%6e%76.%30?v=Ipguo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /%2eenv%2ebuild
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /%2eenv%2ebuild UA Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefo…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/%2eenv%2ebuild
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%2eenv%2ebuild
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%2eenv%2ebuild?v=rJn1Q HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%2eenv%2ebuild?v=rJn1Q HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X11; Linux
Requête brute (extrait)
GET /%2eenv%2ebuild?v=rJn1Q HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/a
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "b90990531c0a083f105f1abc2f8a1c442d3d4441",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 427,
"payload_entropy": 5.500875022463635,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "aace0a3417598bdafd10deb95fd32f5da0b8a1b7",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
"payload_hash": "168b875b9da6cdb0c15272e4a20771ac",
"path_pattern_hash": "fd0d6dec15a072cd95a646a26c231514"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/%2eenv%2ebuild?v=rJn1Q HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux ",
"method": "GET",
"path": "\/%2eenv%2ebuild",
"query_string": "v=rJn1Q",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%2eenv%2ebuild?v=rJn1Q HTTP\/1.1",
"request_sample": "GET \/%2eenv%2ebuild?v=rJn1Q HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/a",
"payload_snippet": "GET \/%2eenv%2ebuild?v=rJn1Q HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"evidence": {
"method": "GET",
"path": "\/%2eenv%2ebuild",
"query_string": "v=rJn1Q",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%2eenv%2ebuild?v=rJn1Q HTTP\/1.1",
"request_sample": "GET \/%2eenv%2ebuild?v=rJn1Q HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/a",
"payload_snippet": "GET \/%2eenv%2ebuild?v=rJn1Q HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ca646b5b93bc417bdff18ea77f7b5d4899ca073c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eenv%2ebuild",
"request_line": "GET \/%2eenv%2ebuild?v=rJn1Q HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%2eenv%2ebuild?v=rJn1Q HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eenv%2ebuild",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eenv%2ebuild",
"request_line": "GET \/%2eenv%2ebuild?v=rJn1Q HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eenv%2ebuild",
"evidence_snippet": "GET \/%2eenv%2ebuild?v=rJn1Q HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%63%6f%70%79
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%63%6f%70%79 UA Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefo…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%63%6f%70%79
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%63%6f%70%79
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /.%65%6e%76.%63%6f%70%79?v=BtcFX HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%63%6f%70%79?v=BtcFX HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X1
Requête brute (extrait)
GET /.%65%6e%76.%63%6f%70%79?v=BtcFX HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/web
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%63%6f%70%79",
"http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "ab5913d4e48821a87b292050dcad0965ef7816d3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 436,
"payload_entropy": 5.55116089966967,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "919487531d144c020b219f0f21a2a5ec1149b659",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
"payload_hash": "4e7a6d68dc35b2c8e8ee448e074412bf",
"path_pattern_hash": "b5d17f2b1ce8f7f64b470880e24e09c8"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%63%6f%70%79?v=BtcFX HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X1",
"method": "GET",
"path": "\/.%65%6e%76.%63%6f%70%79",
"query_string": "v=BtcFX",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%63%6f%70%79?v=BtcFX HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%63%6f%70%79?v=BtcFX HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/web",
"payload_snippet": "GET \/.%65%6e%76.%63%6f%70%79?v=BtcFX HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X1",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%63%6f%70%79",
"query_string": "v=BtcFX",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%63%6f%70%79?v=BtcFX HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%63%6f%70%79?v=BtcFX HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/web",
"payload_snippet": "GET \/.%65%6e%76.%63%6f%70%79?v=BtcFX HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X1",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6d5d585dcae116f650a5a32e582b8edba401ca45",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%63%6f%70%79",
"request_line": "GET \/.%65%6e%76.%63%6f%70%79?v=BtcFX HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%63%6f%70%79?v=BtcFX HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X1",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%63%6f%70%79",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%63%6f%70%79",
"request_line": "GET \/.%65%6e%76.%63%6f%70%79?v=BtcFX HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%63%6f%70%79",
"evidence_snippet": "GET \/.%65%6e%76.%63%6f%70%79?v=BtcFX HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X1",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%63%75%73%74%6f%6d
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%63%75%73%74%6f%6d UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%63%75%73%74%6f%6d
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%63%75%73%74%6f%6d
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.%65%6e%76.%63%75%73%74%6f%6d?v=aiclr HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%63%75%73%74%6f%6d?v=aiclr HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5
Requête brute (extrait)
GET /.%65%6e%76.%63%75%73%74%6f%6d?v=aiclr HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%63%75%73%74%6f%6d",
"http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "9fbc478b5704fb2f102673af661c948ddc4ee595",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 483,
"payload_entropy": 5.561190572579832,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "f0d60166316f1df91947d24ee8cfc74472758da6",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
"payload_hash": "ca2e737bec073dd4f86264f8727c70df",
"path_pattern_hash": "f9a638bee2d64517cb4f1f6894c65e31"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%63%75%73%74%6f%6d?v=aiclr HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5",
"method": "GET",
"path": "\/.%65%6e%76.%63%75%73%74%6f%6d",
"query_string": "v=aiclr",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%63%75%73%74%6f%6d?v=aiclr HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%63%75%73%74%6f%6d?v=aiclr HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,applic",
"payload_snippet": "GET \/.%65%6e%76.%63%75%73%74%6f%6d?v=aiclr HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%63%75%73%74%6f%6d",
"query_string": "v=aiclr",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%63%75%73%74%6f%6d?v=aiclr HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%63%75%73%74%6f%6d?v=aiclr HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,applic",
"payload_snippet": "GET \/.%65%6e%76.%63%75%73%74%6f%6d?v=aiclr HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "96397deb7ab7acebe36d9adfad4e4e820090ae61",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%63%75%73%74%6f%6d",
"request_line": "GET \/.%65%6e%76.%63%75%73%74%6f%6d?v=aiclr HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%63%75%73%74%6f%6d?v=aiclr HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%63%75%73%74%6f%6d",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%63%75%73%74%6f%6d",
"request_line": "GET \/.%65%6e%76.%63%75%73%74%6f%6d?v=aiclr HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%63%75%73%74%6f%6d",
"evidence_snippet": "GET \/.%65%6e%76.%63%75%73%74%6f%6d?v=aiclr HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%63%6f%6e%74%72%61%63%74%73
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%63%6f%6e%74%72%61%63%74%73 UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.%65%6e%76.%63%6f%6e%74%72%61%63%74%73?v=KJIhL HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%63%6f%6e%74%72%61%63%74%73?v=KJIhL HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent:
Requête brute (extrait)
GET /.%65%6e%76.%63%6f%6e%74%72%61%63%74%73?v=KJIhL HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,applica
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%63%6f%6e%74%72%61%63%74%73",
"http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "2419f786fe6d66018298ff3d4c42b59cd8d0414c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 482,
"payload_entropy": 5.5986320727299725,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "f13b758ef3e104ea5d68ca748020037b92554a44",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278",
"payload_hash": "88ca8437896096ee680a3566745d6f70",
"path_pattern_hash": "4312370b5719edfda94c0ff5c84a8974"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73?v=KJIhL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: ",
"method": "GET",
"path": "\/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73",
"query_string": "v=KJIhL",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73?v=KJIhL HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73?v=KJIhL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,applica",
"payload_snippet": "GET \/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73?v=KJIhL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73",
"query_string": "v=KJIhL",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73?v=KJIhL HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73?v=KJIhL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,applica",
"payload_snippet": "GET \/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73?v=KJIhL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent:",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "572634e8b08001882da45200e8cb0dc57deb23be",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73",
"request_line": "GET \/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73?v=KJIhL HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73?v=KJIhL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent:",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73",
"request_line": "GET \/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73?v=KJIhL HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73",
"evidence_snippet": "GET \/.%65%6e%76.%63%6f%6e%74%72%61%63%74%73?v=KJIhL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent:",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%00.env.backup
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00.env.backup UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00.env.backup
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%00.env.backup
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /%00.env.backup HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00.env.backup HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi
Requête brute (extrait)
GET /%00.env.backup HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,application/xht
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "backup",
"http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "a7773aefeac7affd35763abd8395842dd2c9d9ed",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 474,
"payload_entropy": 5.503008228808998,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 65,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9326d42310e37c84ab14d4cac7d8170cc0053235",
"event_fingerprint": "eff0056f3a201da2ab47d23aaf7fd521a18aee17",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
"payload_hash": "fc8523f565159f15c9ab8ee7db5eb277",
"path_pattern_hash": "fc692705551c051f18846870ca91c27c"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%00.env.backup HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"method": "GET",
"path": "\/%00.env.backup",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.backup HTTP\/1.1",
"request_sample": "GET \/%00.env.backup HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xht",
"payload_snippet": "GET \/%00.env.backup HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"evidence": {
"method": "GET",
"path": "\/%00.env.backup",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.backup HTTP\/1.1",
"request_sample": "GET \/%00.env.backup HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xht",
"payload_snippet": "GET \/%00.env.backup HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c07bec2911b5e719378e77651d15c453737e0925",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.backup",
"request_line": "GET \/%00.env.backup HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00.env.backup HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.backup",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.backup",
"request_line": "GET \/%00.env.backup HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.backup",
"evidence_snippet": "GET \/%00.env.backup HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%00.env.copy
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00.env.copy UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00.env.copy
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%00.env.copy
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /%00.env.copy HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00.env.copy HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS
Requête brute (extrait)
GET /%00.env.copy HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Accept: text/html,appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "copy",
"http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "fec19c56c536e5af2f4f2c340428d7c8d004f441",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 485,
"payload_entropy": 5.505778105775832,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 65,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9326d42310e37c84ab14d4cac7d8170cc0053235",
"event_fingerprint": "c602cd369400d52ebf37672a6292861c9b9f550b",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c",
"payload_hash": "c616fbabaa54125d06c622a3f8d7b8dd",
"path_pattern_hash": "ae2b28daa7aef60e5d82276bc70b532e"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%00.env.copy HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS",
"method": "GET",
"path": "\/%00.env.copy",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.copy HTTP\/1.1",
"request_sample": "GET \/%00.env.copy HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html,appl",
"payload_snippet": "GET \/%00.env.copy HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS",
"evidence": {
"method": "GET",
"path": "\/%00.env.copy",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.copy HTTP\/1.1",
"request_sample": "GET \/%00.env.copy HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html,appl",
"payload_snippet": "GET \/%00.env.copy HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2330131982bc8f57bc31d9858552fe86f105cfce",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.copy",
"request_line": "GET \/%00.env.copy HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00.env.copy HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.copy",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.copy",
"request_line": "GET \/%00.env.copy HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.copy",
"evidence_snippet": "GET \/%00.env.copy HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%00.env.bkp
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00.env.bkp UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00.env.bkp
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%00.env.bkp
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%00.env.bkp HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00.env.bkp HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64
Requête brute (extrait)
GET /%00.env.bkp HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,application/xhtml+
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "bkp",
"http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "18c4fb265732834b064604fc1e62f6f147c7680e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 471,
"payload_entropy": 5.502207322389781,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 65,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9326d42310e37c84ab14d4cac7d8170cc0053235",
"event_fingerprint": "f697615159f110e277feae6bb3644d05d0f1ec72",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
"payload_hash": "2997a98571ba651f5d7e646d877aca9e",
"path_pattern_hash": "e3f25dce87e314f27b282ceaeda28979"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%00.env.bkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"method": "GET",
"path": "\/%00.env.bkp",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.bkp HTTP\/1.1",
"request_sample": "GET \/%00.env.bkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtml+",
"payload_snippet": "GET \/%00.env.bkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"evidence": {
"method": "GET",
"path": "\/%00.env.bkp",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.bkp HTTP\/1.1",
"request_sample": "GET \/%00.env.bkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtml+",
"payload_snippet": "GET \/%00.env.bkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "722b9d21bb32cd6aae99e4b170ef9b2f8ae96858",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.bkp",
"request_line": "GET \/%00.env.bkp HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00.env.bkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.bkp",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.bkp",
"request_line": "GET \/%00.env.bkp HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.bkp",
"evidence_snippet": "GET \/%00.env.bkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%00.env.credentials
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00.env.credentials UA Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefo…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00.env.credentials
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%00.env.credentials
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%00.env.credentials HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00.env.credentials HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X11; Linux x86
Requête brute (extrait)
GET /%00.env.credentials HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "credentials",
"http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "c59aed482725803c1300e7aa9c0707c1f0b93d01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 424,
"payload_entropy": 5.435448034288013,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 65,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9326d42310e37c84ab14d4cac7d8170cc0053235",
"event_fingerprint": "01af1153ca6e5d894847e2f55bcaaea892e1eb84",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
"payload_hash": "6fed14bc973b64d5c7bd1c745ac76e6b",
"path_pattern_hash": "5f927f328c55221f7e795dc39c784da4"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%00.env.credentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"method": "GET",
"path": "\/%00.env.credentials",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.credentials HTTP\/1.1",
"request_sample": "GET \/%00.env.credentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng",
"payload_snippet": "GET \/%00.env.credentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"evidence": {
"method": "GET",
"path": "\/%00.env.credentials",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.credentials HTTP\/1.1",
"request_sample": "GET \/%00.env.credentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng",
"payload_snippet": "GET \/%00.env.credentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cd6465504810e1a2f71bf6d7032e1c23ec2efe55",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.credentials",
"request_line": "GET \/%00.env.credentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00.env.credentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.credentials",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.credentials",
"request_line": "GET \/%00.env.credentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.credentials",
"evidence_snippet": "GET \/%00.env.credentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%00.env.0
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00.env.0 UA Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00.env.0
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%00.env.0
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%00.env.0 HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00.env.0 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S9
Requête brute (extrait)
GET /%00.env.0 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Accept: text/html,application/xhtml+xml,appli
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "0",
"http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "84aab5784d7885e7631d351a3289759e4dda28c1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 462,
"payload_entropy": 5.507029121337442,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 65,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9326d42310e37c84ab14d4cac7d8170cc0053235",
"event_fingerprint": "6cf41b951714c731345e75d91df06b6e421f4ae6",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b6437c44634b78992a7fb87fd879dbec",
"payload_hash": "48171f16655600b77d56bf212e36794f",
"path_pattern_hash": "f26d4206a72f3fdd3a244b8392a95ad5"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%00.env.0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S9",
"method": "GET",
"path": "\/%00.env.0",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.0 HTTP\/1.1",
"request_sample": "GET \/%00.env.0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appli",
"payload_snippet": "GET \/%00.env.0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S9",
"evidence": {
"method": "GET",
"path": "\/%00.env.0",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.0 HTTP\/1.1",
"request_sample": "GET \/%00.env.0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appli",
"payload_snippet": "GET \/%00.env.0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S9",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8049ce94b85a9c60cabec3f5ef9d1ed790763740",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.0",
"request_line": "GET \/%00.env.0 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00.env.0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S9",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.0",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.0",
"request_line": "GET \/%00.env.0 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.0",
"evidence_snippet": "GET \/%00.env.0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S9",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.%65%6e%76.%62%75%69%6c%64
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.%65%6e%76.%62%75%69%6c%64 UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.%65%6e%76.%62%75%69%6c%64
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.%65%6e%76.%62%75%69%6c%64
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.%65%6e%76.%62%75%69%6c%64?v=rJn1Q HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.%65%6e%76.%62%75%69%6c%64?v=rJn1Q HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0
Requête brute (extrait)
GET /.%65%6e%76.%62%75%69%6c%64?v=rJn1Q HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,app
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "%62%75%69%6c%64",
"http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "df4486051a8328ec277fc6d553814310e7582bee",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 486,
"payload_entropy": 5.584153680051267,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "0af84d558d6f33ef62d51fd9d0d053548e5ae574",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "28e19718e8682b7b2da889b8120da9bf",
"payload_hash": "431cae4af0895ceb935df7742428486a",
"path_pattern_hash": "284293230881ddb059d0f96e54e0b968"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.%65%6e%76.%62%75%69%6c%64?v=rJn1Q HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 ",
"method": "GET",
"path": "\/.%65%6e%76.%62%75%69%6c%64",
"query_string": "v=rJn1Q",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%62%75%69%6c%64?v=rJn1Q HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%62%75%69%6c%64?v=rJn1Q HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,app",
"payload_snippet": "GET \/.%65%6e%76.%62%75%69%6c%64?v=rJn1Q HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0",
"evidence": {
"method": "GET",
"path": "\/.%65%6e%76.%62%75%69%6c%64",
"query_string": "v=rJn1Q",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.%65%6e%76.%62%75%69%6c%64?v=rJn1Q HTTP\/1.1",
"request_sample": "GET \/.%65%6e%76.%62%75%69%6c%64?v=rJn1Q HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,app",
"payload_snippet": "GET \/.%65%6e%76.%62%75%69%6c%64?v=rJn1Q HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3d243f175d7dcbc86a8b8b53f1da7257c22d901c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%62%75%69%6c%64",
"request_line": "GET \/.%65%6e%76.%62%75%69%6c%64?v=rJn1Q HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.%65%6e%76.%62%75%69%6c%64?v=rJn1Q HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%62%75%69%6c%64",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.%65%6e%76.%62%75%69%6c%64",
"request_line": "GET \/.%65%6e%76.%62%75%69%6c%64?v=rJn1Q HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%62%75%69%6c%64",
"evidence_snippet": "GET \/.%65%6e%76.%62%75%69%6c%64?v=rJn1Q HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%00.env.1
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00.env.1 UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00.env.1
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%00.env.1
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /%00.env.1 HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00.env.1 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18
Requête brute (extrait)
GET /%00.env.1 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Accept: text/html,applica
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "1",
"http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "73ff02bc8b3a251cb7b30e9d012b28eb5040c6d3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 482,
"payload_entropy": 5.503164310156115,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 65,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9326d42310e37c84ab14d4cac7d8170cc0053235",
"event_fingerprint": "26cf3936996d9959de4fa74cf0da28b6bd3cf910",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c",
"payload_hash": "1333ad6849fc6eb09df06d11098ff4c5",
"path_pattern_hash": "36fe9c8463bdcd939509a424d7fb3aec"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%00.env.1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18",
"method": "GET",
"path": "\/%00.env.1",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.1 HTTP\/1.1",
"request_sample": "GET \/%00.env.1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html,applica",
"payload_snippet": "GET \/%00.env.1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18",
"evidence": {
"method": "GET",
"path": "\/%00.env.1",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.1 HTTP\/1.1",
"request_sample": "GET \/%00.env.1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html,applica",
"payload_snippet": "GET \/%00.env.1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4d15b786e61ba6ca344a6771f2033acaca3a0374",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.1",
"request_line": "GET \/%00.env.1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00.env.1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.1",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.1",
"request_line": "GET \/%00.env.1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.1",
"evidence_snippet": "GET \/%00.env.1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%00.env.custom
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00.env.custom UA Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00.env.custom
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%00.env.custom
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%00.env.custom HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00.env.custom HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Linux; Android 14;
Requête brute (extrait)
GET /%00.env.custom HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Accept: text/html,application/xhtml+xml,
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "custom",
"http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "c67180ebaf7543bccb6c5182a8b0f980039f184b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 467,
"payload_entropy": 5.506273491977599,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 65,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9326d42310e37c84ab14d4cac7d8170cc0053235",
"event_fingerprint": "dad8463b29750181e14b17930fef39ee0f8efcd2",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b6437c44634b78992a7fb87fd879dbec",
"payload_hash": "37018f814cdf86ee2810bcf0bcc23ddd",
"path_pattern_hash": "4be5cb5a3e633cea65106d59a3d78de3"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%00.env.custom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; ",
"method": "GET",
"path": "\/%00.env.custom",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.custom HTTP\/1.1",
"request_sample": "GET \/%00.env.custom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,",
"payload_snippet": "GET \/%00.env.custom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"evidence": {
"method": "GET",
"path": "\/%00.env.custom",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.custom HTTP\/1.1",
"request_sample": "GET \/%00.env.custom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,",
"payload_snippet": "GET \/%00.env.custom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "327acf38ee4893dc3752fdd44a3ab03c764680b4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.custom",
"request_line": "GET \/%00.env.custom HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00.env.custom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.custom",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.custom",
"request_line": "GET \/%00.env.custom HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.custom",
"evidence_snippet": "GET \/%00.env.custom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%00.env.azure
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00.env.azure UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00.env.azure
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%00.env.azure
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /%00.env.azure HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00.env.azure HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone O
Requête brute (extrait)
GET /%00.env.azure HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Accept: text/html,app
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "azure",
"http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "e8575ee6209372b9888f5d4a7fb8155f408abb54",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 486,
"payload_entropy": 5.505705522737406,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 65,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9326d42310e37c84ab14d4cac7d8170cc0053235",
"event_fingerprint": "c49b890ea745ef9925fe257f5810aec7f47151f2",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c",
"payload_hash": "a61862eaa894dbec76a9c5e50ef06528",
"path_pattern_hash": "665af7ce3dab5b204cde7d10538d13a7"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%00.env.azure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"method": "GET",
"path": "\/%00.env.azure",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.azure HTTP\/1.1",
"request_sample": "GET \/%00.env.azure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html,app",
"payload_snippet": "GET \/%00.env.azure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"evidence": {
"method": "GET",
"path": "\/%00.env.azure",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.azure HTTP\/1.1",
"request_sample": "GET \/%00.env.azure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html,app",
"payload_snippet": "GET \/%00.env.azure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cf7cda5ca450e2cf40810d0388845cd300291da6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.azure",
"request_line": "GET \/%00.env.azure HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00.env.azure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.azure",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.azure",
"request_line": "GET \/%00.env.azure HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.azure",
"evidence_snippet": "GET \/%00.env.azure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:24 UTC
TCP
9222 · HTTP
Flood / DDoS
http flood · via HTTP:9222 · (tentative d'exploit) · → /%00.env.beta
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00.env.beta UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00.env.beta
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/%00.env.beta
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%00.env.beta HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00.env.beta HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win6
Requête brute (extrait)
GET /%00.env.beta HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,applicati
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "beta",
"http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "edb4ed62eb187c93b0c15fa6371183a4e4cf365d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 458,
"payload_entropy": 5.495927692846786,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 65,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9326d42310e37c84ab14d4cac7d8170cc0053235",
"event_fingerprint": "71ce8e90379e2c0f50e575b6a1ef0d4dcb8a4310",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
"payload_hash": "d060a546cc10ff4e3f629957f25c47ce",
"path_pattern_hash": "6863525454a7b607b665c23cb4561cd5"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/%00.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"method": "GET",
"path": "\/%00.env.beta",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.beta HTTP\/1.1",
"request_sample": "GET \/%00.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applicati",
"payload_snippet": "GET \/%00.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"evidence": {
"method": "GET",
"path": "\/%00.env.beta",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00.env.beta HTTP\/1.1",
"request_sample": "GET \/%00.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applicati",
"payload_snippet": "GET \/%00.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7cfdafcffd33fe8dcd14b7fbb5915cb09333047e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.beta",
"request_line": "GET \/%00.env.beta HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.beta",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00.env.beta",
"request_line": "GET \/%00.env.beta HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.beta",
"evidence_snippet": "GET \/%00.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"asn_dc_heuristic": true
}