21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.aws
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.aws UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.aws
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.aws
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.aws HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.aws HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x
Requête brute (extrait)
GET /.env.aws HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,application/xhtml+xml
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "aws",
"http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "076b05e1b491aec88848a80984fd2fc01270096f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 468,
"payload_entropy": 5.490489084564145,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "8e52d7fd92b44dffeda38ec74f24d6275cd12428",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
"payload_hash": "90c5f80b04c425baf00a13dc1768c2f0",
"path_pattern_hash": "2b3ffe3780b558cb9c98d745388bda06"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.aws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x",
"method": "GET",
"path": "\/.env.aws",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.aws HTTP\/1.1",
"request_sample": "GET \/.env.aws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/.env.aws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x",
"evidence": {
"method": "GET",
"path": "\/.env.aws",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.aws HTTP\/1.1",
"request_sample": "GET \/.env.aws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/.env.aws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7639a41eb238026b047b9363f58573b4afa0edeb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.aws",
"request_line": "GET \/.env.aws HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.aws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.aws",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.aws",
"request_line": "GET \/.env.aws HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.aws",
"evidence_snippet": "GET \/.env.aws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /analytics/.env
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /analytics/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/analytics/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/analytics/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /analytics/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /analytics/.env HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi
Requête brute (extrait)
GET /analytics/.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "0e93fa4e6fa7128e3ad4ebc516d37c89c5d44ad6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "a21eeced4cb9e0e791ca3344be7c61d70bd88b66",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 429,
"payload_entropy": 5.431605127320667,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 67,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "8dd934ff466585323ea4501bd042c7fa10d912d3",
"event_fingerprint": "45a202b3b7641236aed0bb92e447fc07c52420c1",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 67
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "222bb92af5102d5110f0e2e9fad99c71",
"payload_hash": "57d86e5c4630dbd22115afd73a2b2a2a",
"path_pattern_hash": "abca99646405d2644d62c7c362502c4a"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/analytics\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"method": "GET",
"path": "\/analytics\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/analytics\/.env HTTP\/1.1",
"request_sample": "GET \/analytics\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image",
"payload_snippet": "GET \/analytics\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"evidence": {
"method": "GET",
"path": "\/analytics\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/analytics\/.env HTTP\/1.1",
"request_sample": "GET \/analytics\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image",
"payload_snippet": "GET \/analytics\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c549daf0159e3382c47edfc790a262030f2d1c05",
"protocol_details": {
"http_method": "GET",
"http_path": "\/analytics\/.env",
"request_line": "GET \/analytics\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/analytics\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/analytics\/.env",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 67
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/analytics\/.env",
"request_line": "GET \/analytics\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/analytics\/.env",
"evidence_snippet": "GET \/analytics\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.0
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.0 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.0
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.0
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.0 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.0 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64
Requête brute (extrait)
GET /.env.0 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,application/xhtml+xml,a
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "0",
"http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "fa4630e10b906f6cfa29a19c2832908b8c9c3f9e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 466,
"payload_entropy": 5.4871788234180725,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "55e59cd7f694b8cfabb82568a45f30f00041d9b0",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
"payload_hash": "f89da8c1cc76ee7818b1d9dbef0de7e7",
"path_pattern_hash": "31db7baa169118f13de60b877c0348a6"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"method": "GET",
"path": "\/.env.0",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.0 HTTP\/1.1",
"request_sample": "GET \/.env.0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,a",
"payload_snippet": "GET \/.env.0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"evidence": {
"method": "GET",
"path": "\/.env.0",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.0 HTTP\/1.1",
"request_sample": "GET \/.env.0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,a",
"payload_snippet": "GET \/.env.0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "337384164b1dfa98bc4d2adbd411c1fb4d0e34b4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.0",
"request_line": "GET \/.env.0 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.0",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.0",
"request_line": "GET \/.env.0 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.0",
"evidence_snippet": "GET \/.env.0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.creds
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.creds UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.creds
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.creds
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.creds HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.creds HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
GET /.env.creds HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,application/xhtml+x
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "creds",
"http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "f1646d39bfdc1684cf3ffba44b4a0d57eed041f2",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 470,
"payload_entropy": 5.485549554107579,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "d23f6659b185be778f08acf0d97ef2fdafc75344",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
"payload_hash": "22b1484e4e4759e094e8d89821098407",
"path_pattern_hash": "ec42d3575a513073ef7dbd80fa72fa6b"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.creds HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"method": "GET",
"path": "\/.env.creds",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.creds HTTP\/1.1",
"request_sample": "GET \/.env.creds HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtml+x",
"payload_snippet": "GET \/.env.creds HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"method": "GET",
"path": "\/.env.creds",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.creds HTTP\/1.1",
"request_sample": "GET \/.env.creds HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtml+x",
"payload_snippet": "GET \/.env.creds HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "07e2cf2df2a33cec80517586d6fc6cdeefdf2a85",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.creds",
"request_line": "GET \/.env.creds HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.creds HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.creds",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.creds",
"request_line": "GET \/.env.creds HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.creds",
"evidence_snippet": "GET \/.env.creds HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.beta
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.beta UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.beta
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.beta
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.beta HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.beta HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS
Requête brute (extrait)
GET /.env.beta HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "beta",
"http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "81d8b9068d87b642841a100870ef1e7ffab83771",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.486373986549199,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "49fe4238526cb84d173d49c8dab20fd72c98fc0b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "28e19718e8682b7b2da889b8120da9bf",
"payload_hash": "6290d1404c15fcee67c11722864b8958",
"path_pattern_hash": "63e8bcb44fee4a97c57224c223857755"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS ",
"method": "GET",
"path": "\/.env.beta",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.beta HTTP\/1.1",
"request_sample": "GET \/.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applic",
"payload_snippet": "GET \/.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS",
"evidence": {
"method": "GET",
"path": "\/.env.beta",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.beta HTTP\/1.1",
"request_sample": "GET \/.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applic",
"payload_snippet": "GET \/.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e6c82a4a4776447ac80197bc37f324e305cc6eaa",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.beta",
"request_line": "GET \/.env.beta HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.beta",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.beta",
"request_line": "GET \/.env.beta HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.beta",
"evidence_snippet": "GET \/.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.azure
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.azure UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.azure
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.azure
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.azure HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.azure HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
GET /.env.azure HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,application/xhtml+x
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "azure",
"http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "aec6dcc3b6f4b3f44170d4aa77b266a95266ef80",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 470,
"payload_entropy": 5.490935896023698,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "1f25b86d54054b06e2448038d30330b92186f27c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
"payload_hash": "ab41047b7b060a34f050b056fdebd2f8",
"path_pattern_hash": "beffcd3c237c99e5c56a3ccfd20b0dd3"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.azure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"method": "GET",
"path": "\/.env.azure",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.azure HTTP\/1.1",
"request_sample": "GET \/.env.azure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtml+x",
"payload_snippet": "GET \/.env.azure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"method": "GET",
"path": "\/.env.azure",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.azure HTTP\/1.1",
"request_sample": "GET \/.env.azure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtml+x",
"payload_snippet": "GET \/.env.azure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b77a5c67edbbb17d85fdd5eb56c005b81b364b35",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.azure",
"request_line": "GET \/.env.azure HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.azure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.azure",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.azure",
"request_line": "GET \/.env.azure HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.azure",
"evidence_snippet": "GET \/.env.azure HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.build
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.build UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.build
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.build
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.build HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.build HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS
Requête brute (extrait)
GET /.env.build HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept: text/html,application/xhtml+xml,appli
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "build",
"http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "ce02f82a9a79bce8db604125731085fabb0034dd",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 462,
"payload_entropy": 5.489687964700381,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "88d9f320ed49e6c0650e93c8a5852937fa1c14ae",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729",
"payload_hash": "d04dd77b4482a33f97da430368ac16c3",
"path_pattern_hash": "33eb325dec4a5247f1ecc170112855fe"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.build HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS",
"method": "GET",
"path": "\/.env.build",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.build HTTP\/1.1",
"request_sample": "GET \/.env.build HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,appli",
"payload_snippet": "GET \/.env.build HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS",
"evidence": {
"method": "GET",
"path": "\/.env.build",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.build HTTP\/1.1",
"request_sample": "GET \/.env.build HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,appli",
"payload_snippet": "GET \/.env.build HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "44eb500b9fcb01f36b2ae41d97808dc6e36f4634",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.build",
"request_line": "GET \/.env.build HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.build HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.build",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.build",
"request_line": "GET \/.env.build HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.build",
"evidence_snippet": "GET \/.env.build HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.3
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.3 UA Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.3
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.3
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.3?v=kGNyL HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.3?v=kGNyL HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Linux; Android 14;
Requête brute (extrait)
GET /.env.3?v=kGNyL HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Accept: text/html,application/xhtml+xml,
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "3",
"http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "721578b27ad90b1048b654eff6780aff64c51ff3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 467,
"payload_entropy": 5.540387133276035,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "52ef950278f2c0a9c96ba33009727375184b3876",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b6437c44634b78992a7fb87fd879dbec",
"payload_hash": "554e9e50fc9f9d47c473156e290c5a62",
"path_pattern_hash": "564a9dc6cfa2c2ce7f00efd4c308b404"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.3?v=kGNyL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; ",
"method": "GET",
"path": "\/.env.3",
"query_string": "v=kGNyL",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.3?v=kGNyL HTTP\/1.1",
"request_sample": "GET \/.env.3?v=kGNyL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,",
"payload_snippet": "GET \/.env.3?v=kGNyL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"evidence": {
"method": "GET",
"path": "\/.env.3",
"query_string": "v=kGNyL",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.3?v=kGNyL HTTP\/1.1",
"request_sample": "GET \/.env.3?v=kGNyL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,",
"payload_snippet": "GET \/.env.3?v=kGNyL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f73214c77862fed37f0d0d95cc9ae3fdbbc6e6ae",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.3",
"request_line": "GET \/.env.3?v=kGNyL HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.3?v=kGNyL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.3",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.3",
"request_line": "GET \/.env.3?v=kGNyL HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.3",
"evidence_snippet": "GET \/.env.3?v=kGNyL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env?v=vgiL9 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env?v=vgiL9 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win6
Requête brute (extrait)
GET /.env?v=vgiL9 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,application/xhtml
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "env",
"http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "11665ee02e7fc06dfebc2136afbc048623cbbf09",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 472,
"payload_entropy": 5.512905017334462,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 65,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "fb414a36964d5cf47dd1d503eb3af2fc4d77d93b",
"event_fingerprint": "62af2f3b2586dd74c34c8d0e814fe5df4e5e0dc2",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 65
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
"payload_hash": "edf6fd6ff7578d2c8ba074142cab0f09",
"path_pattern_hash": "aef81e7735de8f42b73e111497498c8b"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/.env?v=vgiL9 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"method": "GET",
"path": "\/.env",
"query_string": "v=vgiL9",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env?v=vgiL9 HTTP\/1.1",
"request_sample": "GET \/.env?v=vgiL9 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtml",
"payload_snippet": "GET \/.env?v=vgiL9 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"evidence": {
"method": "GET",
"path": "\/.env",
"query_string": "v=vgiL9",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env?v=vgiL9 HTTP\/1.1",
"request_sample": "GET \/.env?v=vgiL9 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtml",
"payload_snippet": "GET \/.env?v=vgiL9 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "22f8d153479199dc20fa67ef20a8f30b8ea9582e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env",
"request_line": "GET \/.env?v=vgiL9 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env?v=vgiL9 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 65
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env",
"request_line": "GET \/.env?v=vgiL9 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env",
"evidence_snippet": "GET \/.env?v=vgiL9 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_env",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.contracts
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.contracts UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.contracts
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.contracts
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.contracts?v=KJIhL HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.contracts?v=KJIhL HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT
Requête brute (extrait)
GET /.env.contracts?v=KJIhL HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "contracts",
"http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "e187b947d06df072696ec29bbbb57ceca972eed0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 468,
"payload_entropy": 5.521924825240195,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "8135732f1219d0b34564735fd2b55d80213b7660",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
"payload_hash": "77b7c1a0a8e5cdf5d81014763edc69e9",
"path_pattern_hash": "832adf41ecac799a318bb16f335d22c8"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.contracts?v=KJIhL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT ",
"method": "GET",
"path": "\/.env.contracts",
"query_string": "v=KJIhL",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.contracts?v=KJIhL HTTP\/1.1",
"request_sample": "GET \/.env.contracts?v=KJIhL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/.env.contracts?v=KJIhL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"evidence": {
"method": "GET",
"path": "\/.env.contracts",
"query_string": "v=KJIhL",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.contracts?v=KJIhL HTTP\/1.1",
"request_sample": "GET \/.env.contracts?v=KJIhL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/.env.contracts?v=KJIhL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "098b55e740e22652badc7cf162bbf656eb88f4d9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.contracts",
"request_line": "GET \/.env.contracts?v=KJIhL HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.contracts?v=KJIhL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.contracts",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.contracts",
"request_line": "GET \/.env.contracts?v=KJIhL HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.contracts",
"evidence_snippet": "GET \/.env.contracts?v=KJIhL HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /analytics/.env
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /analytics/.env UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/analytics/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/analytics/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /analytics/.env?v=YxyIw HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /analytics/.env?v=YxyIw HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (iPhone; CPU
Requête brute (extrait)
GET /analytics/.env?v=YxyIw HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Accept: text
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "6cdd62d67207b18b614392585635cfe3641a6d1c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 495,
"payload_entropy": 5.530209157341171,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 67,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "8dd934ff466585323ea4501bd042c7fa10d912d3",
"event_fingerprint": "5ebb60d44979e1cb03e631426c79097a41b17af5",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 67
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c",
"payload_hash": "92c0c9df85ef62871b657c56a8f99765",
"path_pattern_hash": "abca99646405d2644d62c7c362502c4a"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/analytics\/.env?v=YxyIw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
"method": "GET",
"path": "\/analytics\/.env",
"query_string": "v=YxyIw",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/analytics\/.env?v=YxyIw HTTP\/1.1",
"request_sample": "GET \/analytics\/.env?v=YxyIw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text",
"payload_snippet": "GET \/analytics\/.env?v=YxyIw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
"evidence": {
"method": "GET",
"path": "\/analytics\/.env",
"query_string": "v=YxyIw",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/analytics\/.env?v=YxyIw HTTP\/1.1",
"request_sample": "GET \/analytics\/.env?v=YxyIw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text",
"payload_snippet": "GET \/analytics\/.env?v=YxyIw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1b7088d9fe8808c83f43f767fbb1c0a2fb0c8b0b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/analytics\/.env",
"request_line": "GET \/analytics\/.env?v=YxyIw HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/analytics\/.env?v=YxyIw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/analytics\/.env",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 67
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/analytics\/.env",
"request_line": "GET \/analytics\/.env?v=YxyIw HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/analytics\/.env",
"evidence_snippet": "GET \/analytics\/.env?v=YxyIw HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.aws
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.aws UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.aws
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.aws
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.aws?v=tZtRH HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.aws?v=tZtRH HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Macintosh; Intel
Requête brute (extrait)
GET /.env.aws?v=tZtRH HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "aws",
"http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "7d4c7ddebafe098c06ddd46b893834991345fa1d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 468,
"payload_entropy": 5.523528631290147,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "8d2154926538d7bc985a016cf4a2d695fa4b55d9",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "28e19718e8682b7b2da889b8120da9bf",
"payload_hash": "4cc76d1bb44342113f0d19a74e59adec",
"path_pattern_hash": "2b3ffe3780b558cb9c98d745388bda06"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.aws?v=tZtRH HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel ",
"method": "GET",
"path": "\/.env.aws",
"query_string": "v=tZtRH",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.aws?v=tZtRH HTTP\/1.1",
"request_sample": "GET \/.env.aws?v=tZtRH HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/.env.aws?v=tZtRH HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"evidence": {
"method": "GET",
"path": "\/.env.aws",
"query_string": "v=tZtRH",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.aws?v=tZtRH HTTP\/1.1",
"request_sample": "GET \/.env.aws?v=tZtRH HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/.env.aws?v=tZtRH HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b2cea7f3360c296eca0c8533691952b2837e1c0a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.aws",
"request_line": "GET \/.env.aws?v=tZtRH HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.aws?v=tZtRH HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.aws",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.aws",
"request_line": "GET \/.env.aws?v=tZtRH HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.aws",
"evidence_snippet": "GET \/.env.aws?v=tZtRH HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.copy
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.copy UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.copy
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.copy
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.copy?v=BtcFX HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.copy?v=BtcFX HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0;
Requête brute (extrait)
GET /.env.copy?v=BtcFX HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "copy",
"http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "6b56beec2ecf5f8c5afc630c83f3257804bc652a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 463,
"payload_entropy": 5.53583116957938,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "a7eabab404b190441faae56e30ec46338dcb0252",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
"payload_hash": "ad8d79c9336159f9273062a931cd0372",
"path_pattern_hash": "1582af18ca1ce6e54d4467e471b637e8"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.copy?v=BtcFX HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"method": "GET",
"path": "\/.env.copy",
"query_string": "v=BtcFX",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.copy?v=BtcFX HTTP\/1.1",
"request_sample": "GET \/.env.copy?v=BtcFX HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appl",
"payload_snippet": "GET \/.env.copy?v=BtcFX HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"evidence": {
"method": "GET",
"path": "\/.env.copy",
"query_string": "v=BtcFX",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.copy?v=BtcFX HTTP\/1.1",
"request_sample": "GET \/.env.copy?v=BtcFX HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appl",
"payload_snippet": "GET \/.env.copy?v=BtcFX HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d48b26e3ca05818ccc55b8b5584aeb87acfe1f7a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.copy",
"request_line": "GET \/.env.copy?v=BtcFX HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.copy?v=BtcFX HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.copy",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.copy",
"request_line": "GET \/.env.copy?v=BtcFX HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.copy",
"evidence_snippet": "GET \/.env.copy?v=BtcFX HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.bak
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.bak UA Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefo…
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
950521:leak-8
Cible HTTP
GET
/.env.bak
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.bak
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.bak?v=ufYSn HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
leak-8
Payload (extrait)
GET /.env.bak?v=ufYSn HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X11; Linux x86_64
Requête brute (extrait)
GET /.env.bak?v=ufYSn HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "bak",
"http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "d9237ce60464d9d113fabca201ecc95f5693aca4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 421,
"payload_entropy": 5.4874757382076655,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 68,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "2f986a6cea55e1aaa0b17f97ab86db7f13cec36f",
"event_fingerprint": "efdecba587b728d11033cc8e262d15d4fb69a190",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 68
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
"payload_hash": "55c78de6b0d8fea38b5fc7e00ded290e",
"path_pattern_hash": "e884c8b66a9cc0dbcd8816b9898313a2"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/.env.bak?v=ufYSn HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"method": "GET",
"path": "\/.env.bak",
"query_string": "v=ufYSn",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.env.bak?v=ufYSn HTTP\/1.1",
"request_sample": "GET \/.env.bak?v=ufYSn HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,*\/",
"payload_snippet": "GET \/.env.bak?v=ufYSn HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"evidence": {
"method": "GET",
"path": "\/.env.bak",
"query_string": "v=ufYSn",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.env.bak?v=ufYSn HTTP\/1.1",
"request_sample": "GET \/.env.bak?v=ufYSn HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,*\/",
"payload_snippet": "GET \/.env.bak?v=ufYSn HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3beb1ec8fad1ec12d91ac4bb68d59a98c7a3fc97",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.bak",
"request_line": "GET \/.env.bak?v=ufYSn HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.bak?v=ufYSn HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.bak",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 68
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.bak",
"request_line": "GET \/.env.bak?v=ufYSn HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.bak",
"evidence_snippet": "GET \/.env.bak?v=ufYSn HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"http_backup_file_scan",
"http_backup_path",
"http_probe_env",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.ci
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.ci UA Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.ci
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.ci
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.ci?v=zJjhf HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.ci?v=zJjhf HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Linux; Android 14;
Requête brute (extrait)
GET /.env.ci?v=zJjhf HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Accept: text/html,application/xhtml+xml
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "ci",
"http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "bf0455de4fbaa7f520bf4ba6b39f61699cf64bef",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 468,
"payload_entropy": 5.54041007239662,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "07451898139db4add287438ee1c0be79c866e8d9",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b6437c44634b78992a7fb87fd879dbec",
"payload_hash": "b966694f62412775441f5658112ee3ef",
"path_pattern_hash": "50f9d36c86f775badf5b5642056ce5d6"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.ci?v=zJjhf HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"method": "GET",
"path": "\/.env.ci",
"query_string": "v=zJjhf",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.ci?v=zJjhf HTTP\/1.1",
"request_sample": "GET \/.env.ci?v=zJjhf HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/.env.ci?v=zJjhf HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"evidence": {
"method": "GET",
"path": "\/.env.ci",
"query_string": "v=zJjhf",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.ci?v=zJjhf HTTP\/1.1",
"request_sample": "GET \/.env.ci?v=zJjhf HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/.env.ci?v=zJjhf HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "deff5f41937721b2dee24c7674fe13b72cda53cb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.ci",
"request_line": "GET \/.env.ci?v=zJjhf HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.ci?v=zJjhf HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.ci",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.ci",
"request_line": "GET \/.env.ci?v=zJjhf HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.ci",
"evidence_snippet": "GET \/.env.ci?v=zJjhf HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.bkp
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.bkp UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.bkp
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.bkp
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.bkp?v=G9ECv HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.bkp?v=G9ECv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0;
Requête brute (extrait)
GET /.env.bkp?v=G9ECv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,application/x
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "bkp",
"http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "20496f93c9aa92731f27bbaed80aca598006ee1c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 476,
"payload_entropy": 5.5248068077167805,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "ad468d75c61ab019509c2fe7e9e1d3ea3560a1e0",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
"payload_hash": "50ae23031507f8c820b5083e9e26e596",
"path_pattern_hash": "40c58bb2665419c2b2f03d76228acf7a"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.bkp?v=G9ECv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; ",
"method": "GET",
"path": "\/.env.bkp",
"query_string": "v=G9ECv",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.bkp?v=G9ECv HTTP\/1.1",
"request_sample": "GET \/.env.bkp?v=G9ECv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/x",
"payload_snippet": "GET \/.env.bkp?v=G9ECv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"evidence": {
"method": "GET",
"path": "\/.env.bkp",
"query_string": "v=G9ECv",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.bkp?v=G9ECv HTTP\/1.1",
"request_sample": "GET \/.env.bkp?v=G9ECv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/x",
"payload_snippet": "GET \/.env.bkp?v=G9ECv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e911b07ed6e885ffb1b8b3ef97ae0ddfe51135f4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.bkp",
"request_line": "GET \/.env.bkp?v=G9ECv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.bkp?v=G9ECv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.bkp",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.bkp",
"request_line": "GET \/.env.bkp?v=G9ECv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.bkp",
"evidence_snippet": "GET \/.env.bkp?v=G9ECv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.custom
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.custom UA Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefo…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.custom
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.custom
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.custom?v=aiclr HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.custom?v=aiclr HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X11; Linux x86
Requête brute (extrait)
GET /.env.custom?v=aiclr HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "custom",
"http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "d7b760a502c09215eea6787692f3a7b2acb81ff1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 424,
"payload_entropy": 5.449510493070202,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "4651d1110595b5f2c6b3269856dde192d55da7d1",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
"payload_hash": "8985ca194b42ec5515a06760cf68bb9a",
"path_pattern_hash": "58b007734fb3874453540d333661ccac"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.custom?v=aiclr HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"method": "GET",
"path": "\/.env.custom",
"query_string": "v=aiclr",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.custom?v=aiclr HTTP\/1.1",
"request_sample": "GET \/.env.custom?v=aiclr HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng",
"payload_snippet": "GET \/.env.custom?v=aiclr HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"evidence": {
"method": "GET",
"path": "\/.env.custom",
"query_string": "v=aiclr",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.custom?v=aiclr HTTP\/1.1",
"request_sample": "GET \/.env.custom?v=aiclr HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng",
"payload_snippet": "GET \/.env.custom?v=aiclr HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9012f3a7c9c68b0f65bcbb2833723b5d0a976089",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.custom",
"request_line": "GET \/.env.custom?v=aiclr HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.custom?v=aiclr HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.custom",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.custom",
"request_line": "GET \/.env.custom?v=aiclr HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.custom",
"evidence_snippet": "GET \/.env.custom?v=aiclr HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.azure
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.azure UA Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefo…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.azure
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.azure
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.azure?v=kEjgJ HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.azure?v=kEjgJ HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X11; Linux x86_
Requête brute (extrait)
GET /.env.azure?v=kEjgJ HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "azure",
"http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "d5ad1c78068107618ed7ab90a3d3800a2cf2fc62",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 423,
"payload_entropy": 5.489060430334674,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "3d122717abb2301c5f076a18da05c327273043dd",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
"payload_hash": "ab7809e18c09de21993e1a5497072a2c",
"path_pattern_hash": "beffcd3c237c99e5c56a3ccfd20b0dd3"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.azure?v=kEjgJ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_",
"method": "GET",
"path": "\/.env.azure",
"query_string": "v=kEjgJ",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.azure?v=kEjgJ HTTP\/1.1",
"request_sample": "GET \/.env.azure?v=kEjgJ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,",
"payload_snippet": "GET \/.env.azure?v=kEjgJ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_",
"evidence": {
"method": "GET",
"path": "\/.env.azure",
"query_string": "v=kEjgJ",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.azure?v=kEjgJ HTTP\/1.1",
"request_sample": "GET \/.env.azure?v=kEjgJ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,",
"payload_snippet": "GET \/.env.azure?v=kEjgJ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b0cb0e8e4b771b588249965e2eecddb489c01eb7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.azure",
"request_line": "GET \/.env.azure?v=kEjgJ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.azure?v=kEjgJ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.azure",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.azure",
"request_line": "GET \/.env.azure?v=kEjgJ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.azure",
"evidence_snippet": "GET \/.env.azure?v=kEjgJ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.0
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.0 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.0
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.0
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.0?v=Ipguo HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.0?v=Ipguo HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi
Requête brute (extrait)
GET /.env.0?v=Ipguo HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "0",
"http_ua_hash": "0e93fa4e6fa7128e3ad4ebc516d37c89c5d44ad6",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "7e210bebd4d23767e3d83b44e6ab30808c436843",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 429,
"payload_entropy": 5.456811474511897,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "4d76eb115b0fa0ade79f760e18822577d349e96b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "222bb92af5102d5110f0e2e9fad99c71",
"payload_hash": "92c0aa458e19549158516988930ffaa9",
"path_pattern_hash": "31db7baa169118f13de60b877c0348a6"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.0?v=Ipguo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"method": "GET",
"path": "\/.env.0",
"query_string": "v=Ipguo",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.0?v=Ipguo HTTP\/1.1",
"request_sample": "GET \/.env.0?v=Ipguo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image",
"payload_snippet": "GET \/.env.0?v=Ipguo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"evidence": {
"method": "GET",
"path": "\/.env.0",
"query_string": "v=Ipguo",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.0?v=Ipguo HTTP\/1.1",
"request_sample": "GET \/.env.0?v=Ipguo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image",
"payload_snippet": "GET \/.env.0?v=Ipguo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b406a86a9f82767580039922fa21ccaf822346a7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.0",
"request_line": "GET \/.env.0?v=Ipguo HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.0?v=Ipguo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.0",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.0",
"request_line": "GET \/.env.0?v=Ipguo HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.0",
"evidence_snippet": "GET \/.env.0?v=Ipguo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.beta
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.beta UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.beta
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.beta
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.beta?v=cAQQd HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.beta?v=cAQQd HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Macintosh; Intel
Requête brute (extrait)
GET /.env.beta?v=cAQQd HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept: text/html,application/xhtml+xm
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "beta",
"http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "ca9de1aada69a5793cdf5a3656617b510de9d573",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 469,
"payload_entropy": 5.512859943586445,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "367f7115abb3a1210189e5f4d0651034542ccaae",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729",
"payload_hash": "ea96048cef640c7c427a48426ca0a60a",
"path_pattern_hash": "63e8bcb44fee4a97c57224c223857755"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.beta?v=cAQQd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"method": "GET",
"path": "\/.env.beta",
"query_string": "v=cAQQd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.beta?v=cAQQd HTTP\/1.1",
"request_sample": "GET \/.env.beta?v=cAQQd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xm",
"payload_snippet": "GET \/.env.beta?v=cAQQd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"evidence": {
"method": "GET",
"path": "\/.env.beta",
"query_string": "v=cAQQd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.beta?v=cAQQd HTTP\/1.1",
"request_sample": "GET \/.env.beta?v=cAQQd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xm",
"payload_snippet": "GET \/.env.beta?v=cAQQd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "50583ba1d91fbe0c132eb61af00d950316f00463",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.beta",
"request_line": "GET \/.env.beta?v=cAQQd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.beta?v=cAQQd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.beta",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.beta",
"request_line": "GET \/.env.beta?v=cAQQd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.beta",
"evidence_snippet": "GET \/.env.beta?v=cAQQd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.4
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.4 UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.4
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.4
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.4?v=Wnkng HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.4?v=Wnkng HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Macintosh; Intel Ma
Requête brute (extrait)
GET /.env.4?v=Wnkng HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,a
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "4",
"http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "d271c10f6625ad5203032cfff2b18f0f5fde759e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 466,
"payload_entropy": 5.5165928742055605,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "1f7a023c1a6f6533b7b794917e4d6efa0ee6196e",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "28e19718e8682b7b2da889b8120da9bf",
"payload_hash": "2e3e062ca2320c11201bc229d12f19cc",
"path_pattern_hash": "c67c76525c03c647503307536b42526f"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.4?v=Wnkng HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"method": "GET",
"path": "\/.env.4",
"query_string": "v=Wnkng",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.4?v=Wnkng HTTP\/1.1",
"request_sample": "GET \/.env.4?v=Wnkng HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,a",
"payload_snippet": "GET \/.env.4?v=Wnkng HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"evidence": {
"method": "GET",
"path": "\/.env.4",
"query_string": "v=Wnkng",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.4?v=Wnkng HTTP\/1.1",
"request_sample": "GET \/.env.4?v=Wnkng HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,a",
"payload_snippet": "GET \/.env.4?v=Wnkng HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4fa08fe77f0aa71156450bcf38e4104953c1e9a5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.4",
"request_line": "GET \/.env.4?v=Wnkng HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.4?v=Wnkng HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.4",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.4",
"request_line": "GET \/.env.4?v=Wnkng HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.4",
"evidence_snippet": "GET \/.env.4?v=Wnkng HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.backup
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.backup UA Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefo…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.backup
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.backup
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
pat-0192
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Probe /.env.backup
Ligne de requête
GET /.env.backup?v=tdaFV HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.backup?v=tdaFV HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X11; Linux x86
Requête brute (extrait)
GET /.env.backup?v=tdaFV HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "backup",
"http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "bd21875cdd391b5b45c7a81acb9c716426e55805",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 424,
"payload_entropy": 5.482448370390853,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "565cdb45481f15570479c5515c7fc68682a9f57c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 325,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0192",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0192",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191",
"pat-0192"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env",
"Probe \/.env.backup"
],
"pattern_ids": [
"pat-0284",
"pat-0191",
"pat-0192"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
"payload_hash": "7bded75462541a39bbb20b89e0754916",
"path_pattern_hash": "46237bd90c824ac71e080a2ce5957ff9"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.backup?v=tdaFV HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"method": "GET",
"path": "\/.env.backup",
"query_string": "v=tdaFV",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.backup?v=tdaFV HTTP\/1.1",
"request_sample": "GET \/.env.backup?v=tdaFV HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng",
"payload_snippet": "GET \/.env.backup?v=tdaFV HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"evidence": {
"method": "GET",
"path": "\/.env.backup",
"query_string": "v=tdaFV",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.backup?v=tdaFV HTTP\/1.1",
"request_sample": "GET \/.env.backup?v=tdaFV HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng",
"payload_snippet": "GET \/.env.backup?v=tdaFV HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "36889d4f2407ab58a8865d982a50d10f4e2a0317",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.backup",
"request_line": "GET \/.env.backup?v=tdaFV HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.backup?v=tdaFV HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.backup",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"pat-0192"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"pat-0192"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.backup",
"request_line": "GET \/.env.backup?v=tdaFV HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.backup",
"evidence_snippet": "GET \/.env.backup?v=tdaFV HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.5
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.5 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.5
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.5
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.5?v=68U1A HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.5?v=68U1A HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi
Requête brute (extrait)
GET /.env.5?v=68U1A HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,applica
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "5",
"http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "0285e8ba707c3f4260d4220f16f1bde5127de9ea",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 460,
"payload_entropy": 5.520822226394174,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "4a90a2955c336f63bc6c8eef2c349562257407fe",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
"payload_hash": "b1878223a4bc3f0f6be3f844f4fea124",
"path_pattern_hash": "b0d056debb409e6a485ed05356b04dbd"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.5?v=68U1A HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"method": "GET",
"path": "\/.env.5",
"query_string": "v=68U1A",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.5?v=68U1A HTTP\/1.1",
"request_sample": "GET \/.env.5?v=68U1A HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applica",
"payload_snippet": "GET \/.env.5?v=68U1A HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"evidence": {
"method": "GET",
"path": "\/.env.5",
"query_string": "v=68U1A",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.5?v=68U1A HTTP\/1.1",
"request_sample": "GET \/.env.5?v=68U1A HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applica",
"payload_snippet": "GET \/.env.5?v=68U1A HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b5564a9be920fd025e74cd6473e231bc380fffc5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.5",
"request_line": "GET \/.env.5?v=68U1A HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.5?v=68U1A HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.5",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.5",
"request_line": "GET \/.env.5?v=68U1A HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.5",
"evidence_snippet": "GET \/.env.5?v=68U1A HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.1
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.1 UA Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) App…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.1
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.1
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.1?v=XMsvE HTTP/1.1
User-Agent
Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.1?v=XMsvE HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozlila/5.0 (Linux; Android 7.0;
Requête brute (extrait)
GET /.env.1?v=XMsvE HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Accept
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "1",
"http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "629f14b9275bb3cd46cc9302059a059fefd258b0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 501,
"payload_entropy": 5.575309031352555,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "a255942f59385867c50f4f3a3b737d065b56eaa7",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9219a56a94233bae47f378d01e805eeb",
"payload_hash": "7877a57abdaaaa9ac1905a3c9ff17c13",
"path_pattern_hash": "246678beffd8d5caa19e157c00fb03d6"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.1?v=XMsvE HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;",
"method": "GET",
"path": "\/.env.1",
"query_string": "v=XMsvE",
"user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.1?v=XMsvE HTTP\/1.1",
"request_sample": "GET \/.env.1?v=XMsvE HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAccept",
"payload_snippet": "GET \/.env.1?v=XMsvE HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;",
"evidence": {
"method": "GET",
"path": "\/.env.1",
"query_string": "v=XMsvE",
"user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.1?v=XMsvE HTTP\/1.1",
"request_sample": "GET \/.env.1?v=XMsvE HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAccept",
"payload_snippet": "GET \/.env.1?v=XMsvE HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "35e18ed763f55d2d67cbdf439363a4137cb952c4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.1",
"request_line": "GET \/.env.1?v=XMsvE HTTP\/1.1",
"http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.1?v=XMsvE HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.1",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.1",
"request_line": "GET \/.env.1?v=XMsvE HTTP\/1.1",
"http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.1",
"evidence_snippet": "GET \/.env.1?v=XMsvE HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.2
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.2 UA Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.2
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.2
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Probe /.env
Ligne de requête
GET /.env.2?v=avmRA HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.2?v=avmRA HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Linux; Android 14;
Requête brute (extrait)
GET /.env.2?v=avmRA HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Accept: text/html,application/xhtml+xml,
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "2",
"http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "e75a6f4a5c7b88c08b5678f48f5b000dfc4879ff",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 467,
"payload_entropy": 5.522165570825502,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "f4a12a15746c5eba842e50fe3432b0a8d28db004",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284",
"pat-0191"
],
"matched_pattern_names": [
"CRS 941130",
"Probe \/.env"
],
"pattern_ids": [
"pat-0284",
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b6437c44634b78992a7fb87fd879dbec",
"payload_hash": "7c60fc15635a475bb840e7118821e25e",
"path_pattern_hash": "9acbbb5564a3ce1b4b0846c8f46815ba"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.2?v=avmRA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; ",
"method": "GET",
"path": "\/.env.2",
"query_string": "v=avmRA",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.2?v=avmRA HTTP\/1.1",
"request_sample": "GET \/.env.2?v=avmRA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,",
"payload_snippet": "GET \/.env.2?v=avmRA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"evidence": {
"method": "GET",
"path": "\/.env.2",
"query_string": "v=avmRA",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.2?v=avmRA HTTP\/1.1",
"request_sample": "GET \/.env.2?v=avmRA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,",
"payload_snippet": "GET \/.env.2?v=avmRA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "33fcea7e646e187fba329b399057fa6098af56b1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.2",
"request_line": "GET \/.env.2?v=avmRA HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.2?v=avmRA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.2",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.2",
"request_line": "GET \/.env.2?v=avmRA HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.2",
"evidence_snippet": "GET \/.env.2?v=avmRA HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde fichier configuration
config file probe · via HTTP:9222 · (tentative d'exploit) · → /.env.credentials
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.credentials UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.credentials
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9222
Chemin / cible
/.env.credentials
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.credentials?v=Li3a3 HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.credentials?v=Li3a3 HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (Macintosh
Requête brute (extrait)
GET /.env.credentials?v=Li3a3 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/x
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "credentials",
"http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "063bff783a48cc840368f0b7757105f5aca968c8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 476,
"payload_entropy": 5.491750289690437,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b9d17d0c98268633c4d4c6b581cede3734c6f694",
"event_fingerprint": "936844d0503629d40325f2f4e392d3a722552036",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "28e19718e8682b7b2da889b8120da9bf",
"payload_hash": "bbb7d2fc0033b1db7ddc592905ee3a93",
"path_pattern_hash": "cc17aa27eab2e30a457d8d01a14e4513"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.credentials?v=Li3a3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh",
"method": "GET",
"path": "\/.env.credentials",
"query_string": "v=Li3a3",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.credentials?v=Li3a3 HTTP\/1.1",
"request_sample": "GET \/.env.credentials?v=Li3a3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/x",
"payload_snippet": "GET \/.env.credentials?v=Li3a3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh",
"evidence": {
"method": "GET",
"path": "\/.env.credentials",
"query_string": "v=Li3a3",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.credentials?v=Li3a3 HTTP\/1.1",
"request_sample": "GET \/.env.credentials?v=Li3a3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/x",
"payload_snippet": "GET \/.env.credentials?v=Li3a3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5bff8525e2169689eccf28fc3689b2cb54922ed2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.credentials",
"request_line": "GET \/.env.credentials?v=Li3a3 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.credentials?v=Li3a3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh",
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.credentials",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.credentials",
"request_line": "GET \/.env.credentials?v=Li3a3 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.credentials",
"evidence_snippet": "GET \/.env.credentials?v=Li3a3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (Macintosh",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:56:22 UTC
TCP
9222 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9222 · (tentative d'exploit)
Élevée
Moyen · 57
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefo…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9222
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 57
Confiance : Confiance 95 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 941130
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gec
Requête brute (extrait)
POST / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9222 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Content-Length: 10 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/ap
Meta JSON brut
{
"http_header_count": 10,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
"http_host_hash": "64f9a50a33b5f0087ecefe96b189405cfa8c0593",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 485,
"payload_entropy": 5.42950924691089,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 9222,
"risk_waf": 72,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 72,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 57,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8c9ae988b8829cac8876a5295f6ae065bf893b14",
"event_fingerprint": "d7016bb633e768214a5236aed113279138855b6b",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0284"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 941130"
],
"pattern_ids": [
"pat-0842",
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
"payload_hash": "5efba36aa243b6f2257450bd967ce523",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9222,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gec",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nContent-Length: 10\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/ap",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gec",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nContent-Length: 10\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/ap",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gec",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3df80e6f9a72feb656aa95775848d02559608c49",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gec",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit)",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 72,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9222,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 9222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9222 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9222\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gec",
"target_port_label": "9222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:12 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /staff/%252eenv
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /staff/%252eenv UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/staff/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/staff/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /staff/%252eenv HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /staff/%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
GET /staff/%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "464db4c4e90f90e5d53e26818795735819bc3f59",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.509824365022426,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
"event_fingerprint": "5142ead2c5acc445ccd23e82d7f3016e4d970a2f",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
"payload_hash": "ce457881a8d5c0a9ed4072d973faa804",
"path_pattern_hash": "06ef90844435e10cf7123574b0b9e9fd"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/staff\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"method": "GET",
"path": "\/staff\/%252eenv",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/staff\/%252eenv HTTP\/1.1",
"request_sample": "GET \/staff\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applic",
"payload_snippet": "GET \/staff\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"method": "GET",
"path": "\/staff\/%252eenv",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/staff\/%252eenv HTTP\/1.1",
"request_sample": "GET \/staff\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applic",
"payload_snippet": "GET \/staff\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cb2906c788cef24b8a9ef8206574fd98c063e245",
"protocol_details": {
"http_method": "GET",
"http_path": "\/staff\/%252eenv",
"request_line": "GET \/staff\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/staff\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/staff\/%252eenv",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/staff\/%252eenv",
"request_line": "GET \/staff\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/staff\/%252eenv",
"evidence_snippet": "GET \/staff\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /%00secrets/%00.env
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00secrets/%00.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00secrets/%00.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/%00secrets/%00.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%00secrets/%00.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00secrets/%00.env HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
GET /%00secrets/%00.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,ap
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "e448358354a089d2ed487a8601276581ae44b21b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 465,
"payload_entropy": 5.4906481297863685,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 67,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
"event_fingerprint": "dd2cd64a427d468bced84000dc0380439109ab2b",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
"payload_hash": "9cd76e451a4d28ab95d27bb9e8067026",
"path_pattern_hash": "c7542a1d43da72d2e46fe1d31e4be1d4"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/%00secrets\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"method": "GET",
"path": "\/%00secrets\/%00.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00secrets\/%00.env HTTP\/1.1",
"request_sample": "GET \/%00secrets\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,ap",
"payload_snippet": "GET \/%00secrets\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"method": "GET",
"path": "\/%00secrets\/%00.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00secrets\/%00.env HTTP\/1.1",
"request_sample": "GET \/%00secrets\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,ap",
"payload_snippet": "GET \/%00secrets\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ca2b7d84ba7032d8682787e745e970e0fa630fe",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00secrets\/%00.env",
"request_line": "GET \/%00secrets\/%00.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00secrets\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00secrets\/%00.env",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00secrets\/%00.env",
"request_line": "GET \/%00secrets\/%00.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00secrets\/%00.env",
"evidence_snippet": "GET \/%00secrets\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /sites/default/%252eenv
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /sites/default/%252eenv UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/sites/default/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/sites/default/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /sites/default/%252eenv HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /sites/default/%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (X11; Linux
Requête brute (extrait)
GET /sites/default/%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,applicat
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "3284cb9a73bd19377e4d4c6ed5ac4bb300f3caa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 459,
"payload_entropy": 5.505085575211572,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "adaa864d7ef06c85582020013d7d4e77358b454a",
"event_fingerprint": "e1aa9ed900257668cf922d5c47643a2701146cf7",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278",
"payload_hash": "87386af95e6c8df35eb2ed993627ef33",
"path_pattern_hash": "bb6de7ffd204c5941537db9969388aa3"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/sites\/default\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"method": "GET",
"path": "\/sites\/default\/%252eenv",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sites\/default\/%252eenv HTTP\/1.1",
"request_sample": "GET \/sites\/default\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applicat",
"payload_snippet": "GET \/sites\/default\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"evidence": {
"method": "GET",
"path": "\/sites\/default\/%252eenv",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sites\/default\/%252eenv HTTP\/1.1",
"request_sample": "GET \/sites\/default\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applicat",
"payload_snippet": "GET \/sites\/default\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7d26d3ebf5aeb2fbe705bfd72c1e1608fb418648",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sites\/default\/%252eenv",
"request_line": "GET \/sites\/default\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sites\/default\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sites\/default\/%252eenv",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sites\/default\/%252eenv",
"request_line": "GET \/sites\/default\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sites\/default\/%252eenv",
"evidence_snippet": "GET \/sites\/default\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal",
"http_sharepoint_probe",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /space/%252eenv
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /space/%252eenv UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/space/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/space/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /space/%252eenv HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /space/%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
GET /space/%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,application/xh
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "8d0e6664a7e663af1880be5f5a3bb137e1576fae",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 475,
"payload_entropy": 5.497523005754636,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
"event_fingerprint": "0a70a8761036b673c07e20c1dd457cc2d2050978",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "817ecf5c09543bd892aad44157e9396f",
"payload_hash": "487f9b5fe8eb5b88fb51fb8669133192",
"path_pattern_hash": "cbfc9d3d56e554f6b4b709a6e7b90cd5"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/space\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"method": "GET",
"path": "\/space\/%252eenv",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/space\/%252eenv HTTP\/1.1",
"request_sample": "GET \/space\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xh",
"payload_snippet": "GET \/space\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"method": "GET",
"path": "\/space\/%252eenv",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/space\/%252eenv HTTP\/1.1",
"request_sample": "GET \/space\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xh",
"payload_snippet": "GET \/space\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7ce45ad6520b6fc5c4e56450c31a477cac2a2f41",
"protocol_details": {
"http_method": "GET",
"http_path": "\/space\/%252eenv",
"request_line": "GET \/space\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/space\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/space\/%252eenv",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/space\/%252eenv",
"request_line": "GET \/space\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/space\/%252eenv",
"evidence_snippet": "GET \/space\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /%00stack/%00.env
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00stack/%00.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00stack/%00.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/%00stack/%00.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%00stack/%00.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00stack/%00.env HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (Windows NT 10.0;
Requête brute (extrait)
GET /%00stack/%00.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "accb08a49b845e4c8af6b87fda3ef514f3775f80",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 463,
"payload_entropy": 5.5005724033024945,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 67,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
"event_fingerprint": "c45f8881581ab840715cbd3b712f0a387a8041f4",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
"payload_hash": "3a2bf6beb2002ed8f0a0c6129fcd749b",
"path_pattern_hash": "7f94618f2032491fb58101b32de23840"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/%00stack\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"method": "GET",
"path": "\/%00stack\/%00.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00stack\/%00.env HTTP\/1.1",
"request_sample": "GET \/%00stack\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appl",
"payload_snippet": "GET \/%00stack\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"evidence": {
"method": "GET",
"path": "\/%00stack\/%00.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00stack\/%00.env HTTP\/1.1",
"request_sample": "GET \/%00stack\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appl",
"payload_snippet": "GET \/%00stack\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bd2f781c8771896d5b28665d431d8a884c1a518a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00stack\/%00.env",
"request_line": "GET \/%00stack\/%00.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00stack\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00stack\/%00.env",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00stack\/%00.env",
"request_line": "GET \/%00stack\/%00.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00stack\/%00.env",
"evidence_snippet": "GET \/%00stack\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /source/%252eenv
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /source/%252eenv UA Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) App…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/source/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/source/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /source/%252eenv HTTP/1.1
User-Agent
Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /source/%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozlila/5.0 (Linux; Android 7.
Requête brute (extrait)
GET /source/%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Acce
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "34a909a2d3d33f692df2692b6e45d5e7b7fbf714",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 503,
"payload_entropy": 5.555375436570151,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
"event_fingerprint": "0d623230ee42c548d7c33f922b01377ff927277c",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9219a56a94233bae47f378d01e805eeb",
"payload_hash": "eaf213f3ad5a51c080cf587de3a5fcd6",
"path_pattern_hash": "6a10e9fda69cc44555cd9bc4786c4abc"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/source\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.",
"method": "GET",
"path": "\/source\/%252eenv",
"user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/source\/%252eenv HTTP\/1.1",
"request_sample": "GET \/source\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAcce",
"payload_snippet": "GET \/source\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.",
"evidence": {
"method": "GET",
"path": "\/source\/%252eenv",
"user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/source\/%252eenv HTTP\/1.1",
"request_sample": "GET \/source\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAcce",
"payload_snippet": "GET \/source\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "19c8450258f4726d4e63f75578d3ff3441e3fdc3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/source\/%252eenv",
"request_line": "GET \/source\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/source\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/source\/%252eenv",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/source\/%252eenv",
"request_line": "GET \/source\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/source\/%252eenv",
"evidence_snippet": "GET \/source\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /socket/%252eenv
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /socket/%252eenv UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/socket/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/socket/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /socket/%252eenv HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /socket/%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (Macintosh; Intel
Requête brute (extrait)
GET /socket/%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept: text/html,application/xhtml+xml
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "61f807cd1be46feb3ba7bedd9a5f939c071df842",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 468,
"payload_entropy": 5.4935783366891595,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
"event_fingerprint": "011fb7cae5f62ae674540f8609de3922ff89bc17",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729",
"payload_hash": "257c40940988a1a46984f43d98789c9e",
"path_pattern_hash": "ade8e66389f2ffdbcb8efba2dad4460d"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/socket\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel ",
"method": "GET",
"path": "\/socket\/%252eenv",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/socket\/%252eenv HTTP\/1.1",
"request_sample": "GET \/socket\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/socket\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"evidence": {
"method": "GET",
"path": "\/socket\/%252eenv",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/socket\/%252eenv HTTP\/1.1",
"request_sample": "GET \/socket\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/socket\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9029414c4aad2d7c08a2d8de165cb9ed93a42e9b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/socket\/%252eenv",
"request_line": "GET \/socket\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/socket\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/socket\/%252eenv",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/socket\/%252eenv",
"request_line": "GET \/socket\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/socket\/%252eenv",
"evidence_snippet": "GET \/socket\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /sources/%252eenv
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /sources/%252eenv UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/sources/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/sources/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /sources/%252eenv HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /sources/%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (Windows NT 10.0;
Requête brute (extrait)
GET /sources/%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,appl
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "7a76de038c8060c0e2b7ce8da463c584274e9fd2",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 463,
"payload_entropy": 5.50457303669356,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
"event_fingerprint": "76b61400bb2acd81f792376b5216cd1f088bec0a",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
"payload_hash": "21d446523100d49650846d89103e5c4c",
"path_pattern_hash": "cb2d201a6932ce642a5fcf8d08bf604e"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/sources\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"method": "GET",
"path": "\/sources\/%252eenv",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sources\/%252eenv HTTP\/1.1",
"request_sample": "GET \/sources\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appl",
"payload_snippet": "GET \/sources\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"evidence": {
"method": "GET",
"path": "\/sources\/%252eenv",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sources\/%252eenv HTTP\/1.1",
"request_sample": "GET \/sources\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appl",
"payload_snippet": "GET \/sources\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "64f791d7f7c7e53fa18a2472760afdfa42b410c0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sources\/%252eenv",
"request_line": "GET \/sources\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sources\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sources\/%252eenv",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sources\/%252eenv",
"request_line": "GET \/sources\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sources\/%252eenv",
"evidence_snippet": "GET \/sources\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /src/%252eenv
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /src/%252eenv UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/src/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/src/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /src/%252eenv HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /src/%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET /src/%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,ap
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "edcdbead8b1f56e9c9429e003726822a53c2aa46",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 465,
"payload_entropy": 5.504011249757397,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
"event_fingerprint": "7ddc37cee4aef4d3995e08f297bf77d1f40d95db",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "28e19718e8682b7b2da889b8120da9bf",
"payload_hash": "e30f50c7e9169312063594a23ba917fd",
"path_pattern_hash": "c0e698c7cca2a2423057dc5cddb027b1"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/src\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/src\/%252eenv",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/%252eenv HTTP\/1.1",
"request_sample": "GET \/src\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,ap",
"payload_snippet": "GET \/src\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/src\/%252eenv",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/src\/%252eenv HTTP\/1.1",
"request_sample": "GET \/src\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,ap",
"payload_snippet": "GET \/src\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fa71c549f0277acdd20513c6159abb57be36b31c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/%252eenv",
"request_line": "GET \/src\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/%252eenv",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/%252eenv",
"request_line": "GET \/src\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/%252eenv",
"evidence_snippet": "GET \/src\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /scanner/%252eenv
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /scanner/%252eenv UA Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/scanner/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/scanner/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /scanner/%252eenv HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /scanner/%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (Linux; Android 1
Requête brute (extrait)
GET /scanner/%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Accept: text/html,application/xhtml+x
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "68db26b63e8973f055585398620439b3651a110f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 470,
"payload_entropy": 5.50429197043307,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
"event_fingerprint": "7aab9e9c703e866810b5324c8c8a3b0b003c95b6",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b6437c44634b78992a7fb87fd879dbec",
"payload_hash": "5cd52ce22ddf8cfa86a00b41a35c36d2",
"path_pattern_hash": "5d7bbd352405eac6095ebfc626b2a7cf"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/scanner\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 1",
"method": "GET",
"path": "\/scanner\/%252eenv",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/scanner\/%252eenv HTTP\/1.1",
"request_sample": "GET \/scanner\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+x",
"payload_snippet": "GET \/scanner\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 1",
"evidence": {
"method": "GET",
"path": "\/scanner\/%252eenv",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/scanner\/%252eenv HTTP\/1.1",
"request_sample": "GET \/scanner\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+x",
"payload_snippet": "GET \/scanner\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 1",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "29dde8cf4a15aa0643b0f00cb24816b222de7480",
"protocol_details": {
"http_method": "GET",
"http_path": "\/scanner\/%252eenv",
"request_line": "GET \/scanner\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/scanner\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 1",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/scanner\/%252eenv",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/scanner\/%252eenv",
"request_line": "GET \/scanner\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/scanner\/%252eenv",
"evidence_snippet": "GET \/scanner\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 1",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit)
Élevée
Moyen · 58
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_flood
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
12378
Chemin / cible
/
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15
Requête brute (extrait)
POST / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Content-Length: 7 Accept: text/html,application/xhtm
Meta JSON brut
{
"http_header_count": 10,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 529,
"payload_entropy": 5.479505064281929,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 58,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "fe230ddaba4ee2b317a45a3cabe50f11c36d1e75",
"event_fingerprint": "77cd5a641eb6867c57f1ae472125cd6ba50d54a3",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 58
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729",
"payload_hash": "0a2cc8c829bb6a8203aaeb76123b7a65",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nContent-Length: 7\r\nAccept: text\/html,application\/xhtm",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nContent-Length: 7\r\nAccept: text\/html,application\/xhtm",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1b8047664058a6eb15b4e7cdcd279654a1c1248f",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit)",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /sql/%252eenv
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /sql/%252eenv UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/sql/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/sql/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /sql/%252eenv HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /sql/%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
GET /sql/%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "0e93fa4e6fa7128e3ad4ebc516d37c89c5d44ad6",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "fc728bea88fdc3c486ea2203a4525a033d48eb56",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 428,
"payload_entropy": 5.463613114494429,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "edfadcc91cb9b1e7cd607cff84b19ab54a5a9261",
"event_fingerprint": "dffe87555fac30a2510f911cc600cb47c1a64559",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "222bb92af5102d5110f0e2e9fad99c71",
"payload_hash": "a69d62c99822665fb5f8d6ed90fb88c4",
"path_pattern_hash": "4b9d38afbbe04bf9158156f2f2e029fa"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/sql\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "GET",
"path": "\/sql\/%252eenv",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sql\/%252eenv HTTP\/1.1",
"request_sample": "GET \/sql\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/",
"payload_snippet": "GET \/sql\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "GET",
"path": "\/sql\/%252eenv",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sql\/%252eenv HTTP\/1.1",
"request_sample": "GET \/sql\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/",
"payload_snippet": "GET \/sql\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8f33df7535e36b11cd7261535394bb6d1caed224",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sql\/%252eenv",
"request_line": "GET \/sql\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sql\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sql\/%252eenv",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sql\/%252eenv",
"request_line": "GET \/sql\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sql\/%252eenv",
"evidence_snippet": "GET \/sql\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal",
"http_probe_sql",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /%00staff/%00.env
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00staff/%00.env UA Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) App…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00staff/%00.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/%00staff/%00.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /%00staff/%00.env HTTP/1.1
User-Agent
Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00staff/%00.env HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozlila/5.0 (Linux; Android 7
Requête brute (extrait)
GET /%00staff/%00.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Acc
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "40e5babf8c38562a8b55abc212c6bc2053cd9dfc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 504,
"payload_entropy": 5.55877165298359,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 67,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
"event_fingerprint": "7b78d05dcf9e93da229710abbe9db5a74870a99c",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9219a56a94233bae47f378d01e805eeb",
"payload_hash": "86bbd2040adc1dc608cb9d1c1bc463fd",
"path_pattern_hash": "ee4f80a6e184efdd89204dfd7735a3ac"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/%00staff\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7",
"method": "GET",
"path": "\/%00staff\/%00.env",
"user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00staff\/%00.env HTTP\/1.1",
"request_sample": "GET \/%00staff\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAcc",
"payload_snippet": "GET \/%00staff\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7",
"evidence": {
"method": "GET",
"path": "\/%00staff\/%00.env",
"user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00staff\/%00.env HTTP\/1.1",
"request_sample": "GET \/%00staff\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAcc",
"payload_snippet": "GET \/%00staff\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e1a8e2dd0f267d3594d987aa4c1854fd792a61d7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00staff\/%00.env",
"request_line": "GET \/%00staff\/%00.env HTTP\/1.1",
"http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00staff\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00staff\/%00.env",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00staff\/%00.env",
"request_line": "GET \/%00staff\/%00.env HTTP\/1.1",
"http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00staff\/%00.env",
"evidence_snippet": "GET \/%00staff\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /software/%252eenv
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /software/%252eenv UA Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) App…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/software/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/software/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /software/%252eenv HTTP/1.1
User-Agent
Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /software/%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozlila/5.0 (Linux; Android
Requête brute (extrait)
GET /software/%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Ac
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "7d07182d82b15e6c4fcd014585f5f42928b4cac1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 505,
"payload_entropy": 5.55839056291942,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
"event_fingerprint": "76f37d360d927ef82a27b43be83005820bc0f4c4",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9219a56a94233bae47f378d01e805eeb",
"payload_hash": "6729eab818b9d19ec5c7c4814b931648",
"path_pattern_hash": "d88f96fa14251714100b77ab95787cbe"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/software\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android ",
"method": "GET",
"path": "\/software\/%252eenv",
"user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/software\/%252eenv HTTP\/1.1",
"request_sample": "GET \/software\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAc",
"payload_snippet": "GET \/software\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android",
"evidence": {
"method": "GET",
"path": "\/software\/%252eenv",
"user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/software\/%252eenv HTTP\/1.1",
"request_sample": "GET \/software\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAc",
"payload_snippet": "GET \/software\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e01b92162ef6ad3c1e20716f2c0e8aec00929b5f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/software\/%252eenv",
"request_line": "GET \/software\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/software\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/software\/%252eenv",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/software\/%252eenv",
"request_line": "GET \/software\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/software\/%252eenv",
"evidence_snippet": "GET \/software\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /spark/%252eenv
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /spark/%252eenv UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/spark/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/spark/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /spark/%252eenv HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /spark/%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone
Requête brute (extrait)
GET /spark/%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Accept: text/html,a
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "3c98de7197dcb6dcfddb3eb1f907a419cdfaf729",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 488,
"payload_entropy": 5.51178738076581,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "1ed03458f224c92d1d7c275e5defa98d881382bf",
"event_fingerprint": "1dfe8e3e413bc15cfb558be21cc1afdbfac629b1",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c",
"payload_hash": "1ed09774abdcdb2d70088809831ea32e",
"path_pattern_hash": "42434636427b91906d683ea462ec5c60"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/spark\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"method": "GET",
"path": "\/spark\/%252eenv",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/spark\/%252eenv HTTP\/1.1",
"request_sample": "GET \/spark\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html,a",
"payload_snippet": "GET \/spark\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"evidence": {
"method": "GET",
"path": "\/spark\/%252eenv",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/spark\/%252eenv HTTP\/1.1",
"request_sample": "GET \/spark\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html,a",
"payload_snippet": "GET \/spark\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "197366c0c9180522ba9e93cf9b403ee4cb78b937",
"protocol_details": {
"http_method": "GET",
"http_path": "\/spark\/%252eenv",
"request_line": "GET \/spark\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/spark\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/spark\/%252eenv",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/spark\/%252eenv",
"request_line": "GET \/spark\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/spark\/%252eenv",
"evidence_snippet": "GET \/spark\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal",
"http_probe_spark",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /secrets/%252eenv
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /secrets/%252eenv UA Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) App…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/secrets/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/secrets/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /secrets/%252eenv HTTP/1.1
User-Agent
Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /secrets/%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozlila/5.0 (Linux; Android 7
Requête brute (extrait)
GET /secrets/%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Acc
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "30b10b12fef2328f8d10c1494b4f068702933476",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 504,
"payload_entropy": 5.548558532539727,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "5cb5c8fab6d97e020979675dec0e0245f2543d53",
"event_fingerprint": "3524e8d80842f9dc313c3dc4fcb9ee80e0f83147",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9219a56a94233bae47f378d01e805eeb",
"payload_hash": "1378fa9c9764f66be8ab8c3edbe47e92",
"path_pattern_hash": "1143e6c7c7369c3ba873634733d29ad1"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/secrets\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7",
"method": "GET",
"path": "\/secrets\/%252eenv",
"user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/secrets\/%252eenv HTTP\/1.1",
"request_sample": "GET \/secrets\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAcc",
"payload_snippet": "GET \/secrets\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7",
"evidence": {
"method": "GET",
"path": "\/secrets\/%252eenv",
"user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/secrets\/%252eenv HTTP\/1.1",
"request_sample": "GET \/secrets\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAcc",
"payload_snippet": "GET \/secrets\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2afbcc0c3613198ee91a617193d2fa377e4a2ed2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets\/%252eenv",
"request_line": "GET \/secrets\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/secrets\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets\/%252eenv",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets\/%252eenv",
"request_line": "GET \/secrets\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets\/%252eenv",
"evidence_snippet": "GET \/secrets\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_k8s_probe",
"http_path_traversal",
"http_probe_secrets",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:11 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /stack/%252eenv
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /stack/%252eenv UA Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/stack/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/stack/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /stack/%252eenv HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /stack/%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (Linux; Android 14;
Requête brute (extrait)
GET /stack/%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Accept: text/html,application/xhtml+xml
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "6fad892261cd20a72c94a1a41ae841b3ef7359bf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 468,
"payload_entropy": 5.513619048004767,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
"event_fingerprint": "8a0703978242ebe1e5c0ce2f5f807acb63724a51",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b6437c44634b78992a7fb87fd879dbec",
"payload_hash": "f901d0eafcbc6efdd0f7ee68a877ebd4",
"path_pattern_hash": "9d0de3cb0ae5f6b63aa1a122501b966b"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/stack\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"method": "GET",
"path": "\/stack\/%252eenv",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/stack\/%252eenv HTTP\/1.1",
"request_sample": "GET \/stack\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/stack\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"evidence": {
"method": "GET",
"path": "\/stack\/%252eenv",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/stack\/%252eenv HTTP\/1.1",
"request_sample": "GET \/stack\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/stack\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "846739ad52e03da739aa4f4928e655e51c88867f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/stack\/%252eenv",
"request_line": "GET \/stack\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/stack\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/stack\/%252eenv",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/stack\/%252eenv",
"request_line": "GET \/stack\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/stack\/%252eenv",
"evidence_snippet": "GET \/stack\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:10 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /%00sso/%00.env
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00sso/%00.env UA Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefo…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00sso/%00.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/%00sso/%00.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%00sso/%00.env HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00sso/%00.env HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
Requête brute (extrait)
GET /%00sso/%00.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "cb76a4c0fd100b3594265e9262c2847a68369d2f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 420,
"payload_entropy": 5.456855425692618,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 67,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
"event_fingerprint": "4635545de55a63159c495ae2744fdaf57b996dfa",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36",
"payload_hash": "9fcb5d6b6df8865325bc66a49151a361",
"path_pattern_hash": "d66c7e50941120afeef27ea231f543cd"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/%00sso\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;",
"method": "GET",
"path": "\/%00sso\/%00.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00sso\/%00.env HTTP\/1.1",
"request_sample": "GET \/%00sso\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,*\/*",
"payload_snippet": "GET \/%00sso\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;",
"evidence": {
"method": "GET",
"path": "\/%00sso\/%00.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00sso\/%00.env HTTP\/1.1",
"request_sample": "GET \/%00sso\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,*\/*",
"payload_snippet": "GET \/%00sso\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "769c69a56e645ac766b28175038957e98cb49a67",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00sso\/%00.env",
"request_line": "GET \/%00sso\/%00.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00sso\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00sso\/%00.env",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00sso\/%00.env",
"request_line": "GET \/%00sso\/%00.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00sso\/%00.env",
"evidence_snippet": "GET \/%00sso\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:10 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /signal/%252eenv
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /signal/%252eenv UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/signal/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/signal/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /signal/%252eenv HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /signal/%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (Macintosh; Intel
Requête brute (extrait)
GET /signal/%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept: text/html,application/xhtml+xml
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "07ff705f5393a2147d60ebf0c7cee7249e2966c8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 468,
"payload_entropy": 5.491432414394334,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
"event_fingerprint": "42463801bdb4b1e10f8397c2c9329cc5445847cc",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729",
"payload_hash": "369ee52a89b8a8afe5714f3972848c68",
"path_pattern_hash": "820ed51acdcc03d62e44153bced89045"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/signal\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel ",
"method": "GET",
"path": "\/signal\/%252eenv",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/signal\/%252eenv HTTP\/1.1",
"request_sample": "GET \/signal\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/signal\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"evidence": {
"method": "GET",
"path": "\/signal\/%252eenv",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/signal\/%252eenv HTTP\/1.1",
"request_sample": "GET \/signal\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml",
"payload_snippet": "GET \/signal\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "726926fab62453f01ebf8c81fba118a2e2075ff7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/signal\/%252eenv",
"request_line": "GET \/signal\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/signal\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/signal\/%252eenv",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/signal\/%252eenv",
"request_line": "GET \/signal\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/signal\/%252eenv",
"evidence_snippet": "GET \/signal\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:10 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit)
Élevée
Moyen · 58
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_flood
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
12378
Chemin / cible
/
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 941130
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/
Requête brute (extrait)
POST / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Length: 18 Accept: text/html,application/xhtml+xml,applicati
Meta JSON brut
{
"http_header_count": 10,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 525,
"payload_entropy": 5.5453386816338055,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 58,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "fe230ddaba4ee2b317a45a3cabe50f11c36d1e75",
"event_fingerprint": "77cd5a641eb6867c57f1ae472125cd6ba50d54a3",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0842",
"pat-0284"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 941130"
],
"pattern_ids": [
"pat-0842",
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 58
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278",
"payload_hash": "b6b2c234c592fbac83b9c0b86861eb4a",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nContent-Length: 18\r\nAccept: text\/html,application\/xhtml+xml,applicati",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nContent-Length: 18\r\nAccept: text\/html,application\/xhtml+xml,applicati",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7dcd00c5d8b54efac276d82029eb59f5af2df894",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit)",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:10 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /%00sms/%00.env
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00sms/%00.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00sms/%00.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/%00sms/%00.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /%00sms/%00.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00sms/%00.env HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
GET /%00sms/%00.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,applic
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "cb87a8475d85e578e635182354e9dcb54d6b4e53",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.501161038694932,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 67,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
"event_fingerprint": "c46bf3ed9e2ef2d61cbb8f2a2fdfe313078be347",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052",
"payload_hash": "1441db1cb36a4c0b2bdf2bea8c0ac242",
"path_pattern_hash": "8b554fc52dd2764321be5a9c7eb2a2ae"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/%00sms\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"method": "GET",
"path": "\/%00sms\/%00.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00sms\/%00.env HTTP\/1.1",
"request_sample": "GET \/%00sms\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applic",
"payload_snippet": "GET \/%00sms\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"method": "GET",
"path": "\/%00sms\/%00.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00sms\/%00.env HTTP\/1.1",
"request_sample": "GET \/%00sms\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applic",
"payload_snippet": "GET \/%00sms\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "684eadb42c34f10e60b2a0f23aff4fbe55bcf8c7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00sms\/%00.env",
"request_line": "GET \/%00sms\/%00.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00sms\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00sms\/%00.env",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00sms\/%00.env",
"request_line": "GET \/%00sms\/%00.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00sms\/%00.env",
"evidence_snippet": "GET \/%00sms\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:10 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /%00social/%00.env
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /%00social/%00.env UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/%00social/%00.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/%00social/%00.env
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /%00social/%00.env HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /%00social/%00.env HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (iPhone; CPU iPh
Requête brute (extrait)
GET /%00social/%00.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Accept: text/htm
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "9728c6cb6388e359669f424e44a0545e68a3e04b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 491,
"payload_entropy": 5.507996714824664,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 67,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "67a6fdda7e26989e8900bd83c5ab7bc8194fbabd",
"event_fingerprint": "84ba80c3302190015ca9fcbc04c748eeeb42f92c",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c",
"payload_hash": "789beff7e59b1495b302e4a77edb8cb2",
"path_pattern_hash": "ac9c4f2d6e580b9d03f6348c70067358"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/%00social\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPh",
"method": "GET",
"path": "\/%00social\/%00.env",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00social\/%00.env HTTP\/1.1",
"request_sample": "GET \/%00social\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/htm",
"payload_snippet": "GET \/%00social\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPh",
"evidence": {
"method": "GET",
"path": "\/%00social\/%00.env",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/%00social\/%00.env HTTP\/1.1",
"request_sample": "GET \/%00social\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/htm",
"payload_snippet": "GET \/%00social\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPh",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "287dc990b0b179716ef9a125b7191e9058acae51",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00social\/%00.env",
"request_line": "GET \/%00social\/%00.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%00social\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPh",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00social\/%00.env",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%00social\/%00.env",
"request_line": "GET \/%00social\/%00.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00social\/%00.env",
"evidence_snippet": "GET \/%00social\/%00.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPh",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"net_flood"
],
"asn_dc_heuristic": true
}
21/07/2026 05:51:10 UTC
TCP
12378 · HTTP
Flood / DDoS
http flood · via HTTP:12378 · (tentative d'exploit) · → /sensor/%252eenv
Élevée
Élevé · 68
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /sensor/%252eenv UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/sensor/%252eenv
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12378
Chemin / cible
/sensor/%252eenv
Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
Ligne de requête
GET /sensor/%252eenv HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /sensor/%252eenv HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378
User-Agent: Mozilla/5.0 (X11; Linux x86_64
Requête brute (extrait)
GET /sensor/%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242",
"http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a",
"http_target_hash": "f69ac536211b1cbb5022d48c26a0219ba6a82602",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 452,
"payload_entropy": 5.5073848812912765,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "SG",
"dst_port": 12378,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "e75b3c20ecbb886e3f0de5aec396324b30c8b7a4",
"event_fingerprint": "e17711be53e10acaba931b844f221aa0c7adc590",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278",
"payload_hash": "1f7c33392c10e758d35842e6027ccb02",
"path_pattern_hash": "9ba09966196c446e1663816bba82c026"
},
"target_context": {
"dst_port": 12378,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/sensor\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"method": "GET",
"path": "\/sensor\/%252eenv",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sensor\/%252eenv HTTP\/1.1",
"request_sample": "GET \/sensor\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml",
"payload_snippet": "GET \/sensor\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"evidence": {
"method": "GET",
"path": "\/sensor\/%252eenv",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/sensor\/%252eenv HTTP\/1.1",
"request_sample": "GET \/sensor\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml",
"payload_snippet": "GET \/sensor\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cb4217c8e76b69c22a61e74699d2c4916300bffe",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sensor\/%252eenv",
"request_line": "GET \/sensor\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sensor\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sensor\/%252eenv",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12378,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sensor\/%252eenv",
"request_line": "GET \/sensor\/%252eenv HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36",
"port": 12378,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sensor\/%252eenv",
"evidence_snippet": "GET \/sensor\/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"target_port_label": "12378 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12378"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_path_traversal",
"net_flood"
],
"asn_dc_heuristic": true
}