Fiche IP

Panama

170.231.236.98

Activité suspecte · risque 40/100

FAI GRUPO PANAGLOBAL 15 S.A Première vue 12/10/2026 09:08 UTC Dernière vue 27/10/2026 20:34 UTC Risque Moyen

Période 2026-09-27 → 2026-10-27

Moyen 55/100

24h 7j 30j 90j

Synthèse

Score de risque max. 55/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 12/10/2026 09:08 UTC

Dernière observation 27/10/2026 20:34 UTC

Événements (période) 359

Décision conseillée Surveiller Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal TA0007 279 occurrences

Pourquoi listée

Type « Sonde SMTPS (465/TCP) » (signaux protocolaires) · confiance 66%

Confiance 66 % — Score WAF 8

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

55/100 Confiance 66 % 359 événements TA0007

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 170.231.236.98
Décision : Investiguer
Score max : 55/100 (Moyen)
Confiance : 66 %
Période : 2026-09-27 → 2026-10-27 · 359 événements
Motif : Type « Sonde SMTPS (465/TCP) » (signaux protocolaires) · confiance 66%
MITRE : TA0007
FAI : GRUPO PANAGLOBAL 15 S.A · Panama

Comparaison ASN / FAI

ASN 264617 · 170.231.236.0/24 · LACNIC — 2 pair(s) ASN/FAI listé(s) sur la base · 359 événements sur la période pour cette IP.

185.191.236.38 Sonde Elasticsearch 27/10/2026 04:54 UTC
170.231.237.214 Sonde API 27/10/2026 03:06 UTC

Événements (filtres)

359

Première observation

12/10/2026 09:08 UTC

Dernière observation

27/10/2026 20:34 UTC

Dernière activité (filtres)

27/10/2026 20:34 UTC

Événements 7j

161

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 51 IRC TCP 37 POSTGRES TCP 18 MONGODB TCP 18 ORACLE TCP 14 MODBUS TCP 13 HTTPS TCP 12 NFS TCP 11 MONGODB SHARD TCP 9 SMB TCP 9 SSH TCP 9 MSSQL TCP 9 ELASTICSEARCH TRANSPORT TCP 8 K8S API TCP 7 LPD TCP 7 LDAP TCP 6 CASSANDRA TCP 6 KAFKA TCP 6 ZOOKEEPER TCP 6 KIBANA TCP 6

HTTP

IRC

POSTGRES

MONGODB

ORACLE

MODBUS

Géolocalisation

Origine réseau déclarée

Panama unknown unknown

FAI / réseau

Opérateur et dernière activité ban

GRUPO PANAGLOBAL 15 S.A 0 Port 5601 Sonde API

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

port 465 tcp · via SMTPS:465 · (sonde / probe)

Détails protocole

SMTP: Sonde protocole SMTP

Aperçu payload

EHLO 62.3.50.33

Port / service

465 · SMTPS

Service émulé

SMTPS

Raison confiance

Confiance 66 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

Email Smtp Auth

Confiance

66%

Famille de menace

unknown IP signalée (IPsum, 3 listes ou plus)

MITRE ATT&CK — tactiques observées

Découverte Accès initial

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

359 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

359 événement(s) — page 3/15

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
25/10/2026 21:53:02 UTC	TCP	1433 · MSSQL	mssql	Sonde MSSQL mssql probe · via MSSQL:1433 · (sonde / probe)	Élevée	Faible · 30
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Émulateur MSSQL WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern mssql_emulated mssql_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1433 Chemin / cible — Service MSSQL Payload GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Moz Pourquoi cette classification : Type « Sonde MSSQL » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 30 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Moz Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36 Meta JSON brut {"protocol_emulated":true,"emulator_response":"001f00001a00060000000000000000000000000000000000000000000000000000","emulator_response_len":33,"bytes_in":238,"payload_entropy":5.508890400716213,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"mssql","app_proto":"mssql","asn":264617,"country":"PA","dst_port":1433,"risk_waf":8,"risk_classification":56,"risk_behavior":0,"risk_geo":0,"risk_protocol":46,"risk_novelty":25,"risk_boost":20,"risk_granularity":2.9,"risk_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":46,"novelty":25},"risk_score":30,"tag_count":5,"anomaly_count":0,"campaign_key":"f93adaca9f40880298f96a6f0f3e4baf34caa9e9","event_fingerprint":"6e104f6072c052d0dd22893d2f1fa140642f7c7c","classification_reason":"Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":46,"novelty":25,"risk_score":30,"correlation_boost":8},"named_classification_skipped":false,"service_name":"mssql","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"94c4e3a41c9e1ea0199007c2f9af64a7","path_pattern_hash":"6d4ca317e1154f7afb07772c79279a04"},"target_context":{"dst_port":143…
25/10/2026 21:49:11 UTC	TCP	995 · POP3S	pop3s	Sonde POP3S (995/TCP) port 995 tcp · via POP3S:995 · (sonde / probe)	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur POP3S WAF — Recommandation Surveiller Tags net_pop3_probe pop3s_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 995 Chemin / cible — Preuve honeypot — Sonde POP3S (995/TCP) Connexion détectée sur le port 995 (TCP) du capteur simulé. Service POP3S Pourquoi cette classification : Type « Sonde POP3S (995/TCP) » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Moyen · 40 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"2b4f4b20504f503320686f6e6579706f742072656164790d0a","emulator_response_len":25,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"well_known","org":"GRUPO PANAGLOBAL 15 S.A","service":"pop3s","app_proto":"pop3s","asn":264617,"country":"PA","dst_port":995,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.2,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":40,"tag_count":2,"anomaly_count":0,"campaign_key":"97403f9f6bf8313ef2b67cdc1a7d7f2645da71b2","event_fingerprint":"0353453bbb76e4d6b1b3ea18095b3c0820f92351","classification_reason":"Type \u00ab port_995_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":40},"named_classification_skipped":true,"named_candidate":"pop3_probe","service_name":"pop3s","risk_confidence_factor":55,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"2d7323af9a60223f53b8a7244c835e47"},"target_context":{"dst_port":995,"service":"pop3s","service_name":"pop3s","risk_s…
25/10/2026 21:49:10 UTC	TCP	995 · POP3S	pop3s	Sonde POP3S (995/TCP) port 995 tcp · via POP3S:995 · (sonde / probe)	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur POP3S WAF — Recommandation Surveiller Tags net_pop3_probe pop3s_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 995 Chemin / cible — Preuve honeypot — Sonde POP3S (995/TCP) Connexion détectée sur le port 995 (TCP) du capteur simulé. Service POP3S Payload �� D��V��"�O<\@�;��-��V� ��FJRK�;�:��B��u�JA�Rθ{��z2̨̩�+�/�,�0� �� /5� �#�'<�� Pourquoi cette classification : Type « Sonde POP3S (995/TCP) » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Moyen · 40 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) ��D��V��"�O<\@�;��-��V� ��FJRK�;�:��B��u�JA�Rθ{��z2̨̩�+�/�,�0� �� /5� �#�'<�� Requête brute (extrait) �� D��V��"�O<\@�;��-��V� ��FJRK�;�:��B��u�JA�Rθ{��z2̨̩�+�/�,�0� �� /5� �#�'<��o � �� 2 + Meta JSON brut {"protocol_emulated":true,"emulator_response":"2b4f4b20504f503320686f6e6579706f742072656164790d0a","emulator_response_len":25,"bytes_in":1523,"payload_entropy":7.690350431404852,"port_category":"well_known","org":"GRUPO PANAGLOBAL 15 S.A","service":"pop3s","app_proto":"pop3s","asn":264617,"country":"PA","dst_port":995,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.5,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":30,"novelty":15},"risk_score":40,"tag_count":3,"anomaly_count":0,"campaign_key":"71fb6554660ec7f81d99778d69d864b9864989b0","event_fingerprint":"0353453bbb76e4d6b1b3ea18095b3c0820f92351","classification_reason":"Type \u00ab port_995_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":30,"novelty":15,"risk_score":40},"named_classification_skipped":true,"named_candidate":"pop3_probe","service_name":"pop3s","risk_confidence_factor":55,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"66ec1cbf5c49a5d2b0c67ffee33df886","path_pattern_hash":"2d7323af9a60223f53b8a7244c835e47"},"target_context":{"dst_port":995,"serv…
25/10/2026 21:49:05 UTC	TCP	995 · POP3S	pop3s	Sonde POP3S (995/TCP) port 995 tcp · via POP3S:995 · (sonde / probe)	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur POP3S WAF — Recommandation Surveiller Tags net_pop3_probe pop3s_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 995 Chemin / cible — Preuve honeypot — Sonde POP3S (995/TCP) Connexion détectée sur le port 995 (TCP) du capteur simulé. Service POP3S Pourquoi cette classification : Type « Sonde POP3S (995/TCP) » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Moyen · 40 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"2b4f4b20504f503320686f6e6579706f742072656164790d0a","emulator_response_len":25,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"well_known","org":"GRUPO PANAGLOBAL 15 S.A","service":"pop3s","app_proto":"pop3s","asn":264617,"country":"PA","dst_port":995,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.2,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":40,"tag_count":2,"anomaly_count":0,"campaign_key":"97403f9f6bf8313ef2b67cdc1a7d7f2645da71b2","event_fingerprint":"0353453bbb76e4d6b1b3ea18095b3c0820f92351","classification_reason":"Type \u00ab port_995_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":40},"named_classification_skipped":true,"named_candidate":"pop3_probe","service_name":"pop3s","risk_confidence_factor":55,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"2d7323af9a60223f53b8a7244c835e47"},"target_context":{"dst_port":995,"service":"pop3s","service_name":"pop3s","risk_s…
25/10/2026 21:39:42 UTC	TCP	8888 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8888 · (sonde / probe)	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur HTTP WAF — Recommandation Surveiller Tags http_alt_dev_port http_alt_port net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8888 Chemin / cible — Service HTTP Pourquoi cette classification : Type « Sonde HTTP » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"http","app_proto":"http","asn":264617,"country":"PA","dst_port":8888,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.6,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":33,"novelty":0},"risk_score":40,"tag_count":3,"anomaly_count":0,"campaign_key":"e132b7a93880e919448f711550d0d8bf10970ccf","event_fingerprint":"61c8f0ddf9885efd02ea09b63a976499994ebc75","city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"4154520a4208b3f021f35a6cc1dd98ae"},"service_name":"http","target_context":{"dst_port":8888,"service":"http","service_name":"http","risk_score":40},"classification_reason":"Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%","confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":33,"novelty":0,"risk_score":40},"attack_stage":"probe","mitre_tactics":["TA0007","TA0001"],"mitre":"TA0007","threat_fami…
25/10/2026 21:15:37 UTC	TCP	631 · IPP	ipp	Sonde IPP ipp · via IPP:631 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur IPP WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 631 Chemin / cible — Service IPP Pourquoi cette classification : Type « Sonde IPP » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f742069707020726561647920706f72743d3633310d0a","emulator_response_len":33,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"well_known","org":"GRUPO PANAGLOBAL 15 S.A","service":"ipp","app_proto":"ipp","asn":264617,"country":"PA","dst_port":631,"risk_waf":8,"risk_classification":0,"risk_behavior":0,"risk_geo":0,"risk_protocol":22,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.8,"risk_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0},"risk_score":0,"tag_count":0,"anomaly_count":0,"campaign_key":"d71f3907be7ed0f46f8494fbd62bda27aff2fd9e","event_fingerprint":"0ff2363c0156fd28c9def3540d5e442f36179298","classification_reason":"Type \u00ab ipp \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":0},"named_classification_skipped":false,"service_name":"ipp","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"705e09bea990ea8643df74d79aabe770"},"target_context":{"dst_port":631,"service":"ipp","service_name":"ipp","risk_score":0},"attack_stage":"probe","mitre_tactics…
25/10/2026 21:05:39 UTC	TCP	139 · SMB	smb	Sonde SMB smb probe · via SMB:139 · (sonde / probe)	Élevée	Faible · 31
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Émulateur SMB WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_smb_probe smb_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 139 Chemin / cible — Service SMB Payload GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Moz Pourquoi cette classification : Type « Sonde SMB » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 31 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Moz Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15 Meta JSON brut {"protocol_emulated":true,"emulator_response":"00000048","emulator_response_len":4,"bytes_in":248,"payload_entropy":5.401087957582949,"port_category":"well_known","org":"GRUPO PANAGLOBAL 15 S.A","service":"smb","app_proto":"smb","asn":264617,"country":"PA","dst_port":139,"risk_waf":8,"risk_classification":56,"risk_behavior":0,"risk_geo":0,"risk_protocol":46,"risk_novelty":15,"risk_boost":20,"risk_granularity":3.8,"risk_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":46,"novelty":15},"risk_score":31,"tag_count":4,"anomaly_count":0,"campaign_key":"1ceb1e2c6867b0741e089aebaec3e795704a2009","event_fingerprint":"ac6f19094f4476f2d5f4af354de6040603cc1eb7","classification_reason":"Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":46,"novelty":15,"risk_score":31,"correlation_boost":8},"named_classification_skipped":false,"service_name":"smb","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"8628fa7e62f369d38d8cd9a38e35c061","path_pattern_hash":"b6c073dc229e6284b4cae7886c46d504"},"target_context":{"dst_port":139,"service":"smb","service_name":"smb","risk_score":31},"payload_prev…
25/10/2026 21:05:32 UTC	TCP	139 · SMB	smb	Sonde SMB smb probe · via SMB:139 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Émulateur SMB WAF — Recommandation Surveiller Tags net_smb_probe smb_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 139 Chemin / cible — Service SMB Pourquoi cette classification : Type « Sonde SMB » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 21 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"well_known","org":"GRUPO PANAGLOBAL 15 S.A","service":"smb","app_proto":"smb","asn":264617,"country":"PA","dst_port":139,"risk_waf":8,"risk_classification":56,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.1,"risk_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":21,"tag_count":2,"anomaly_count":0,"campaign_key":"3953f1b3149bc01b700c2aadb2669056e2e94dea","event_fingerprint":"ac6f19094f4476f2d5f4af354de6040603cc1eb7","classification_reason":"Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":21,"correlation_boost":8},"named_classification_skipped":false,"service_name":"smb","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"b6c073dc229e6284b4cae7886c46d504"},"target_context":{"dst_port":139,"service":"smb","service_name":"smb","risk_score":21},"attack_stage":"probe","mitre_tactics":["TA0007","TA0001"],"mitre":"TA0007","threat_family":["scanner"],"recommen…
25/10/2026 21:04:43 UTC	TCP	5672 · AMQP	amqp	Sonde AMQP amqp probe · via AMQP:5672 · (sonde / probe)	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Découverte Accès Protocole Émulateur AMQP WAF — Recommandation Surveiller Tags amqp_emulated amqp_handshake net_amqp_probe rabbitmq_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5672 Chemin / cible — Service AMQP Payload AMQP Pourquoi cette classification : Type « Sonde AMQP » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 48 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux Proto Amqp Auth Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) AMQP Meta JSON brut {"protocol_emulated":true,"emulator_response":"414d515000000901010000000000000e000a000b000000000000000000","emulator_response_len":29,"bytes_in":8,"payload_entropy":2.4056390622295662,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"amqp","app_proto":"amqp","asn":264617,"country":"PA","dst_port":5672,"risk_waf":8,"risk_classification":43,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":6.2,"risk_breakdown":{"waf":8,"classification":43,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":48,"tag_count":4,"anomaly_count":0,"campaign_key":"28b98d5caf6ffaf3e2c06647254040509400d9f6","event_fingerprint":"b0beb8729344e0fecf193ea4915355ace522129f","classification_reason":"Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":87,"precision_signals":["INT-PROTO-amqp-auth","INT-upstream"],"kb_rule_ids":["INT-PROTO-amqp-auth","INT-upstream"],"confidence_breakdown":{"waf":8,"classification":43,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":48,"correlation_boost":8},"named_classification_skipped":false,"service_name":"amqp","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"1bd4e1ce725fa76b0601c758046093de","path_pattern_hash":"e0a8a2707ca9342…
25/10/2026 21:04:39 UTC	TCP	5672 · AMQP	amqp	Sonde AMQP amqp probe · via AMQP:5672 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Émulateur AMQP WAF — Recommandation Surveiller Tags amqp_emulated net_amqp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5672 Chemin / cible — Service AMQP Pourquoi cette classification : Type « Sonde AMQP » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 34 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"414d515000000901010000000000000e000a000b000000000000000000","emulator_response_len":29,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"amqp","app_proto":"amqp","asn":264617,"country":"PA","dst_port":5672,"risk_waf":8,"risk_classification":43,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":5.5,"risk_breakdown":{"waf":8,"classification":43,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":34,"tag_count":2,"anomaly_count":0,"campaign_key":"3c308f8fd5cfff9a9db195da83935563a4496121","event_fingerprint":"b0beb8729344e0fecf193ea4915355ace522129f","classification_reason":"Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":43,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":34,"correlation_boost":8},"named_classification_skipped":false,"service_name":"amqp","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"e0a8a2707ca9342b66a175c0e4383ba0"},"target_context":{"dst_port":5672,"service":"amqp","service_name":"amqp","risk_score":3…
25/10/2026 21:03:37 UTC	TCP	5432 · POSTGRES	postgres	Sonde PostgreSQL postgresql probe · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_postgresql_probe postgres_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Pourquoi cette classification : Type « Sonde PostgreSQL » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 34 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"postgres","app_proto":"postgres","asn":264617,"country":"PA","dst_port":5432,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.8,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":34,"tag_count":2,"anomaly_count":0,"campaign_key":"272205ffb91c9631a06988b863bb09a8579d4d67","event_fingerprint":"4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f","classification_reason":"Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":34,"correlation_boost":8},"named_classification_skipped":false,"service_name":"postgres","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"2e6f775d89e58a7f725edffbb3ac7743"},"target_context":{"dst_port":5432,"service":"postgres","service_name":"postgres","risk_score":34},"attack_stage":"probe","mitre_tactics":["TA0007","TA0001"],"mitre":"TA0007","th…
25/10/2026 21:03:36 UTC	TCP	5432 · POSTGRES	postgres	Sonde PostgreSQL postgresql probe · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_postgresql_probe postgres_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload &!��Cookie: mstshash= Pourquoi cette classification : Type « Sonde PostgreSQL » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 34 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) &!��Cookie: mstshash= Meta JSON brut {"protocol_emulated":true,"bytes_in":38,"payload_entropy":4.0907125542057665,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"postgres","app_proto":"postgres","asn":264617,"country":"PA","dst_port":5432,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.8,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":34,"tag_count":2,"anomaly_count":0,"campaign_key":"272205ffb91c9631a06988b863bb09a8579d4d67","event_fingerprint":"4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f","classification_reason":"Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":34,"correlation_boost":8},"named_classification_skipped":false,"service_name":"postgres","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"9a1fa403b1d46b8ef0499027f7fb6915","path_pattern_hash":"2e6f775d89e58a7f725edffbb3ac7743"},"target_context":{"dst_port":5432,"service":"postgres","service_name":"postgres","risk_score":34},"payload_preview":"\u0003\u0000\u0000&!\…
25/10/2026 21:03:34 UTC	TCP	5432 · POSTGRES	postgres	Sonde PostgreSQL (5432/TCP) port 5432 tcp · via POSTGRES:5432 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_postgresql_probe postgres_emulated ssh_banner ssh_openssh Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Preuve honeypot — Sonde PostgreSQL (5432/TCP) Connexion détectée sur le port 5432 (TCP) du capteur simulé. Service POSTGRES Payload SSH-2.0-OpenSSH_8.9 Pourquoi cette classification : Bannière client SSH reçue · confiance 66% Confiance classification 74% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 66 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Signaux Cve 2024 6387 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH_8.9 Meta JSON brut {"protocol_emulated":true,"bytes_in":21,"payload_entropy":3.725650756112093,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"postgres","app_proto":"postgres","asn":264617,"country":"PA","dst_port":5432,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":10,"risk_boost":0,"risk_granularity":2.9,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":36,"novelty":10},"risk_score":42,"tag_count":5,"anomaly_count":0,"campaign_key":"865187eaa8d0c6420c6836928d0d3a37d9956573","event_fingerprint":"4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 66%","confidence":0.74,"classification_confidence":0.74,"precision_score":78,"precision_signals":["INT-CVE-2024-6387"],"kb_rule_ids":["INT-CVE-2024-6387"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":36,"novelty":10,"risk_score":42,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"ssh_probe","service_name":"postgres","risk_confidence_factor":66,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"1c72a6bc9b7f32b15ab311610e229bad","path_pattern_hash":"d943d6c5be0b5f6ac0e178b059fb362e"},"target_context":{"dst_port":5432,"service":"postgres","service_name":"postgres","risk_sco…
25/10/2026 21:03:29 UTC	TCP	5432 · POSTGRES	postgres	Sonde PostgreSQL postgresql probe · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_postgresql_probe postgres_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Pourquoi cette classification : Type « Sonde PostgreSQL » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 34 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"postgres","app_proto":"postgres","asn":264617,"country":"PA","dst_port":5432,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.8,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":34,"tag_count":2,"anomaly_count":0,"campaign_key":"272205ffb91c9631a06988b863bb09a8579d4d67","event_fingerprint":"4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f","classification_reason":"Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":34,"correlation_boost":8},"named_classification_skipped":false,"service_name":"postgres","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"2e6f775d89e58a7f725edffbb3ac7743"},"target_context":{"dst_port":5432,"service":"postgres","service_name":"postgres","risk_score":34},"attack_stage":"probe","mitre_tactics":["TA0007","TA0001"],"mitre":"TA0007","th…
25/10/2026 21:03:12 UTC	TCP	5432 · POSTGRES	postgres	Sonde PostgreSQL postgresql probe · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload �/ Pourquoi cette classification : Type « Sonde PostgreSQL » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 34 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) �/ Meta JSON brut {"protocol_emulated":true,"emulator_response":"0000001252000000057573657200706f73746772657300","emulator_response_len":23,"bytes_in":8,"payload_entropy":2.4056390622295662,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"postgres","app_proto":"postgres","asn":264617,"country":"PA","dst_port":5432,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.2,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":34,"tag_count":3,"anomaly_count":0,"campaign_key":"12b185c5c936d11db56861a0ba267c300ed0e15e","event_fingerprint":"4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f","classification_reason":"Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":34,"correlation_boost":8},"named_classification_skipped":false,"service_name":"postgres","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"694bec2754742b999eb8e010ccd19ce8","path_pattern_hash":"2e6f775d89e58a7f725edffbb3ac7743"},"target_context":{"dst_port":5432,"service"…
25/10/2026 21:00:01 UTC	TCP	5269 · XMPP SERVER	xmpp-server	Botnet Mozi mozi pattern · via XMPP SERVER:5269 · (commande & contrôle)	Élevée	Faible · 39
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0011 Commande Protocole Émulateur XMPP-SERVER WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5269 Chemin / cible — Service XMPP SERVER Payload GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Moz Pourquoi cette classification : Type « Botnet Mozi » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 39 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE Commande & contrôle User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Moz Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420786d70705f73657276657220726561647920706f72743d353236390d0a","emulator_response_len":42,"bytes_in":244,"payload_entropy":5.489740192116478,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"xmpp-server","app_proto":"xmpp-server","asn":264617,"country":"PA","dst_port":5269,"risk_waf":8,"risk_classification":82,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":15,"risk_boost":20,"risk_granularity":5.8,"risk_breakdown":{"waf":8,"classification":82,"behavior":0,"geo":0,"protocol":40,"novelty":15},"risk_score":39,"tag_count":3,"anomaly_count":0,"campaign_key":"72603aaffbf1ee894ace56f0248fe28010da3144","event_fingerprint":"81285a7918b0faa288181305b7940fac0197e66a","classification_reason":"Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":82,"behavior":0,"geo":0,"protocol":40,"novelty":15,"risk_score":39,"correlation_boost":8},"named_classification_skipped":false,"service_name":"xmpp-server","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"21e6dca013dbc03c78f20f8930f710c0","path_pattern_hash":"762d384fab941f6d0c2239f19994f3…
25/10/2026 20:59:48 UTC	TCP	5269 · XMPP SERVER	xmpp-server	Sonde serveur XMPP xmpp-server · via XMPP SERVER:5269 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Émulateur XMPP-SERVER WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5269 Chemin / cible — Service XMPP SERVER Pourquoi cette classification : Type « Sonde serveur XMPP » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420786d70705f73657276657220726561647920706f72743d353236390d0a","emulator_response_len":42,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"xmpp-server","app_proto":"xmpp-server","asn":264617,"country":"PA","dst_port":5269,"risk_waf":8,"risk_classification":0,"risk_behavior":0,"risk_geo":0,"risk_protocol":22,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.8,"risk_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0},"risk_score":0,"tag_count":0,"anomaly_count":0,"campaign_key":"6ce692c76dc2fefa1962c4c5266127163a321ed8","event_fingerprint":"1174ca06b0d630a32ea9986362a46d3eb877699d","classification_reason":"Type \u00ab xmpp-server \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":0,"correlation_boost":8},"named_classification_skipped":false,"service_name":"xmpp-server","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"5c4be8c65d327cf4843f6fc5278dcec6"},"target_context":{"dst_port":5269,"service":…
25/10/2026 20:57:45 UTC	TCP	5222 · XMPP	xmpp	Sonde XMPP xmpp probe · via XMPP:5222 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur XMPP WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_xmpp_probe xmpp_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5222 Chemin / cible — Service XMPP Payload GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Moz Pourquoi cette classification : Type « Sonde XMPP » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 33 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Moz Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36 Meta JSON brut {"protocol_emulated":true,"emulator_response":"3c3f786d6c2076657273696f6e3d22312e30223f3e3c73747265616d3a73747265616d20786d6c6e733d226a61626265723a636c69656e74222066726f6d3d22686f6e6579706f742e6c6f63616c222069643d22687031223e3c73747265616d3a66656174757265733e3c6d656368616e69736d7320786d6c6e733d2275726e","emulator_response_len":218,"bytes_in":250,"payload_entropy":5.4923475374915185,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"xmpp","app_proto":"xmpp","asn":264617,"country":"PA","dst_port":5222,"risk_waf":8,"risk_classification":42,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":25,"risk_boost":20,"risk_granularity":4,"risk_breakdown":{"waf":8,"classification":42,"behavior":0,"geo":0,"protocol":40,"novelty":25},"risk_score":33,"tag_count":5,"anomaly_count":0,"campaign_key":"90ed83a88d5c6d5fb3c76c87cd2fa10b37c4791b","event_fingerprint":"e9276407314d5a0114cd546a2ee8e5043be9e0f6","classification_reason":"Type \u00ab xmpp_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":42,"behavior":0,"geo":0,"protocol":40,"novelty":25,"risk_score":33},"named_classification_skipped":false,"service_name":"xmpp","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":fa…
25/10/2026 04:40:37 UTC	TCP	11211 · MEMCACHED	memcached	Sonde Memcached (11211/TCP) port 11211 tcp · via MEMCACHED:11211 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur MEMCACHED WAF — Recommandation Surveiller Tags memcached_emulated memcached_payload net_memcached_probe ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 11211 Chemin / cible — Preuve honeypot — Sonde Memcached (11211/TCP) Connexion détectée sur le port 11211 (TCP) du capteur simulé. Service MEMCACHED Payload SSH-2.0-OpenSSH_8.9 Pourquoi cette classification : Bannière client SSH reçue · confiance 66% Confiance classification 66% Risque capteur Moyen · 42 Confiance : Confiance 66 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Signaux Cve 2024 6387 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH_8.9 Meta JSON brut {"protocol_emulated":true,"emulator_response":"56455253494f4e20312e362e360d0a","emulator_response_len":15,"bytes_in":21,"payload_entropy":3.725650756112093,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"memcached","app_proto":"memcached","asn":264617,"country":"PA","dst_port":11211,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":10,"risk_boost":0,"risk_granularity":5.3,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":30,"novelty":10},"risk_score":42,"tag_count":6,"anomaly_count":0,"campaign_key":"cb250a4ef2fd68c28bd95bbd50bb7dd91e9b5f20","event_fingerprint":"2fcce8d4fd15e6ca50ec0235eeed2c6616def357","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 66%","confidence":0.66,"classification_confidence":0.66,"precision_score":78,"precision_signals":["INT-CVE-2024-6387"],"kb_rule_ids":["INT-CVE-2024-6387"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":30,"novelty":10,"risk_score":42},"named_classification_skipped":true,"named_candidate":"ssh_probe","service_name":"memcached","risk_confidence_factor":66,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"1c72a6bc9b7f32b15ab311610e229bad","path_pattern_hash":"48b1a076dc23c50e43b8064cbe138621"},"target_context":{"dst_port"…
25/10/2026 04:40:33 UTC	TCP	11211 · MEMCACHED	memcached	Sonde Memcached memcached probe · via MEMCACHED:11211 · (sonde / probe)	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole Émulateur MEMCACHED WAF — Recommandation Surveiller Tags memcached_emulated memcached_payload net_memcached_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 11211 Chemin / cible — Service MEMCACHED Memcached Requête stats Memcached (UDP/TCP) Payload stats Pourquoi cette classification : Type « Sonde Memcached » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 48 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux Infra Memcached Stats Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) stats Meta JSON brut {"protocol_emulated":true,"emulator_response":"454e440d0a","emulator_response_len":5,"bytes_in":7,"payload_entropy":2.2359263506290326,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"memcached","app_proto":"memcached","asn":264617,"country":"PA","dst_port":11211,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.2,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":48,"tag_count":3,"anomaly_count":0,"campaign_key":"66464a82723b1788e29428c6a1128b7840beb1bb","event_fingerprint":"2fcce8d4fd15e6ca50ec0235eeed2c6616def357","classification_reason":"Type \u00ab memcached_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":0.95,"classification_confidence":0.95,"precision_score":83,"precision_signals":["INT-INFRA-memcached-stats","INT-upstream"],"kb_rule_ids":["INT-INFRA-memcached-stats","INT-upstream"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":48},"named_classification_skipped":false,"service_name":"memcached","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"11e629574907d3a9ced402e26f4a98df","path_pattern_hash":"549d36783f9e3c43618e715d78a40b3b"},"target_cont…
25/10/2026 03:02:24 UTC	TCP	9200 · ELASTICSEARCH	elasticsearch	Tentative d'exploit exploit attempt · via ELASTICSEARCH:9200 · (tentative d'exploit)	Élevée	Moyen · 48
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 Accès Exécution Protocole GET / Requête Elasticsearch : / UA Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KH… Émulateur ELASTICSEARCH WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_elasticsearch_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9200 Chemin / cible / Service ELASTICSEARCH Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 48 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Moz Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36 Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c","emulator_response_len":172,"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"ead7ae60592167531f6f2cc34364819b196cfa4a","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":243,"payload_entropy":5.495354927510774,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"elasticsearch","app_proto":"elasticsearch","asn":264617,"country":"PA","dst_port":9200,"risk_waf":72,"risk_classification":72,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.2,"risk_breakdown":{"waf":72,"classification":72,"behavior":0,"geo":0,"protocol":40,"novelty":15},"risk_score":48,"tag_count":4,"anomaly_count":0,"campaign_key":"1588160a3e3161f8047fceed07bc1754ee5a47dd","event_fingerprint":"9fad56c821c1c5ddd2cc50fc2ca67d9c1727e39e","classification_reason":"Tentative d'exploit (tag rce-0) \u00b7 confiance 62%","confidence":0.7,"classification_confidence":0.7,"precision_score":73,"precision_signals":["MITRE-T1190"],"kb…
25/10/2026 02:59:45 UTC	TCP	9100 · JETDIRECT	jetdirect	Sonde SSH Sonde SSH · via JETDIRECT:9100 · (sonde / probe)	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags net_ssh_probe ssh_banner ssh_openssh ssh_openssh_8.9 Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload SSH-2.0-OpenSSH_8.9 Pourquoi cette classification : Bannière client SSH reçue · confiance 95% Confiance classification 95% Risque capteur Moyen · 48 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux Cve 2024 6387 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH_8.9 Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a","emulator_response_len":40,"bytes_in":21,"payload_entropy":3.725650756112093,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"jetdirect","app_proto":"jetdirect","asn":264617,"country":"PA","dst_port":9100,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.1,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":48,"tag_count":4,"anomaly_count":0,"campaign_key":"468b99f588e26dda49472969ff9d570d4d494c9b","event_fingerprint":"4ff66fb818a6d21f6172febd90b5fd5618b74c1a","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%","confidence":0.95,"classification_confidence":0.95,"precision_score":103,"precision_signals":["INT-CVE-2024-6387","INT-upstream"],"kb_rule_ids":["INT-CVE-2024-6387","INT-upstream"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":48},"named_classification_skipped":false,"service_name":"jetdirect","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"1c72a6bc9b7f32b15ab311610e229bad","path_pattern_hash":"4368b1c212b6962…
25/10/2026 02:59:44 UTC	TCP	9100 · JETDIRECT	jetdirect	Botnet Mozi mozi pattern · via JETDIRECT:9100 · (commande & contrôle)	Élevée	Faible · 37
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 Commande Protocole Émulateur JETDIRECT WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9100 Chemin / cible — Service JETDIRECT Payload GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Moz Pourquoi cette classification : Type « Botnet Mozi » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 37 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE Commande & contrôle User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Moz Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33 Accept: / Accept-Encoding: identity Accept-Language: en-US;q=0.8,en;q=0.7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36 Edg/88.0.705.56 Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a","emulator_response_len":40,"bytes_in":259,"payload_entropy":5.486413004253817,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"jetdirect","app_proto":"jetdirect","asn":264617,"country":"PA","dst_port":9100,"risk_waf":8,"risk_classification":82,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":15,"risk_boost":20,"risk_granularity":3.8,"risk_breakdown":{"waf":8,"classification":82,"behavior":0,"geo":0,"protocol":40,"novelty":15},"risk_score":37,"tag_count":3,"anomaly_count":0,"campaign_key":"b362c8436efcbf6e793e749c5f77f26c49f6f6d9","event_fingerprint":"4eb4d5d58ec22bdf2146f812070ea6ca88d25a86","classification_reason":"Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":82,"behavior":0,"geo":0,"protocol":40,"novelty":15,"risk_score":37},"named_classification_skipped":false,"service_name":"jetdirect","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"60f2584a696437973597b3c29ad34bdd","path_pattern_hash":"762d384fab941f6d0c2239f19994f30e"},"target_context":{"dst_port":9100…
25/10/2026 02:43:44 UTC	TCP	9092 · KAFKA	kafka	Sonde Kafka kafka probe · via KAFKA:9092 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur KAFKA WAF — Recommandation Surveiller Tags kafka_emulated net_kafka_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9092 Chemin / cible — Service KAFKA Pourquoi cette classification : Type « Sonde Kafka » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"0000000c0000000000000001000b0000","emulator_response_len":16,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"kafka","app_proto":"kafka","asn":264617,"country":"PA","dst_port":9092,"risk_waf":8,"risk_classification":56,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.1,"risk_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":21,"tag_count":2,"anomaly_count":0,"campaign_key":"f632f5f154b29d5dedb5aab9f3d57ade60db5f1b","event_fingerprint":"c474d9c3f8c0776c7c96d4f25d2b0651552d8fad","classification_reason":"Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":21},"named_classification_skipped":false,"service_name":"kafka","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"369bfdf011acc5969bcb68a7ffd2ca13"},"target_context":{"dst_port":9092,"service":"kafka","service_name":"kafka","risk_score":21},"attack_stage":"probe","mitre_tactics":["TA00…
25/10/2026 02:43:43 UTC	TCP	9092 · KAFKA	kafka	Sonde Kafka kafka probe · via KAFKA:9092 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur KAFKA WAF — Recommandation Surveiller Tags kafka_api_versions kafka_emulated net_kafka_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9092 Chemin / cible — Service KAFKA Payload OPTIONS / RTSP/1.0 Pourquoi cette classification : Type « Sonde Kafka » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) OPTIONS / RTSP/1.0 Meta JSON brut {"protocol_emulated":true,"emulator_response":"0000000c4f4e532000000001000b0000","emulator_response_len":16,"bytes_in":22,"payload_entropy":3.73215889136457,"port_category":"registered","org":"GRUPO PANAGLOBAL 15 S.A","service":"kafka","app_proto":"kafka","asn":264617,"country":"PA","dst_port":9092,"risk_waf":8,"risk_classification":56,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.5,"risk_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":21,"tag_count":3,"anomaly_count":0,"campaign_key":"5604a3b4a980b044150539d817f4f4e048b2b9c1","event_fingerprint":"c474d9c3f8c0776c7c96d4f25d2b0651552d8fad","classification_reason":"Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":21},"named_classification_skipped":false,"service_name":"kafka","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PA","asn":264617,"org":"GRUPO PANAGLOBAL 15 S.A","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b9373ea592d67ff8b93af91f8352abc2","path_pattern_hash":"369bfdf011acc5969bcb68a7ffd2ca13"},"target_context":{"dst_port":9092,"service":"kafka","service_name":"kafka","risk_score":21},"payload…

170.231.236.98

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence