15/07/2026 12:04:15 UTC
TCP
5082 · TLS
Sonde port 5082/TCP
port 5082 tcp · via TLS:5082 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5082
Chemin / cible
—
Preuve honeypot — Sonde port 5082/TCP
Connexion détectée sur le port 5082 (TCP) du capteur simulé.
Service
TLS
Payload
� �d��9�wXiF�ʨ���u [ l�cV� v"� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « port_5082_tcp » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 40
Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes
Signaux
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d��9�wXiF�ʨ���u [ l�cV� v"� *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d��9�wXiF�ʨ���u [ l�cV� v"� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.943575784358001,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5082,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "51af4bfffcc2d4bd3ed454a9be497cb66a56568e",
"event_fingerprint": "5a70cf32a4f87f41412901f0fc0f818e6707459f",
"classification_reason": "Type \u00ab port_5082_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0348"
],
"kb_rule_ids": [
"pat-0348"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "f883a05eb9559714029660aafdf1a326",
"path_pattern_hash": "f3dc4a4ae43cdb6195cd700e49b028c5",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5082,
"service": "tls",
"service_name": "tls",
"risk_score": 40
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd9\ufffdwXiF\ufffd\u02a8\ufffd\ufffd\ufffdu [\u000b\u001el\ufffd\u0019cV\ufffd\u001c\u0006v\"\ufffd\u0003\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd9\ufffdwXiF\ufffd\u02a8\ufffd\ufffd\ufffdu [\u000b\u001el\ufffd\u0019cV\ufffd\u001c\u0006v\"\ufffd\u0003\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd9\ufffdwXiF\ufffd\u02a8\ufffd\ufffd\ufffdu [\u000b\u001el\ufffd\u0019cV\ufffd\u001c\u0006v\"\ufffd\u0003\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab port_5082_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8c8040ea6a243471a688731b270bf34f9061356b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd9\ufffdwXiF\ufffd\u02a8\ufffd\ufffd\ufffdu [\u000b\u001el\ufffd\u0019cV\ufffd\u001c\u0006v\"\ufffd\u0003\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5082,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd9\ufffdwXiF\ufffd\u02a8\ufffd\ufffd\ufffdu [l\ufffdcV\ufffdv\"\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "port 5082 tcp \u00b7 via TLS:5082 \u00b7 (sonde \/ probe)",
"target_port_label": "5082 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_5082_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab port_5082_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5082,
"protocol_emulated": null,
"tags_summary": [
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0348"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd9\ufffdwXiF\ufffd\u02a8\ufffd\ufffd\ufffdu [\u000b\u001el\ufffd\u0019cV\ufffd\u001c\u0006v\"\ufffd\u0003\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5082,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port 5082 tcp \u00b7 via TLS:5082 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd9\ufffdwXiF\ufffd\u02a8\ufffd\ufffd\ufffdu [l\ufffdcV\ufffdv\"\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5082 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
15/07/2026 11:12:34 UTC
TCP
5086 · TLS
Sonde TLS
tls probe · via TLS:5086 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5086
Chemin / cible
—
Service
TLS
Payload
� �d� �j��۠��ux�@��ZS*�X��<�S�� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d� �j��۠��ux�@��ZS*�X��<�S�� *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d� �j��۠��ux�@��ZS*�X��<�S�� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.963035674412407,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "HK",
"dst_port": 5086,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "6a330e9254a68e7515b9c9811c3abf96202ae723",
"event_fingerprint": "b7be1a134d45be590436e257254e8f3d221fc127",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "487c7f78de9581b187760493f583df7a",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5086,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u001d\ufffdj\ufffd\ufffd\u06e0\b\ufffd\ufffdux\ufffd\u000e@\ufffd\ufffdZS*\ufffdX\ufffd\ufffd<\ufffdS\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u001d\ufffdj\ufffd\ufffd\u06e0\b\ufffd\ufffdux\ufffd\u000e@\ufffd\ufffdZS*\ufffdX\ufffd\ufffd<\ufffdS\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u001d\ufffdj\ufffd\ufffd\u06e0\b\ufffd\ufffdux\ufffd\u000e@\ufffd\ufffdZS*\ufffdX\ufffd\ufffd<\ufffdS\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "77bd3fc8c6cf888bac6a8626216b3b9721444965",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u001d\ufffdj\ufffd\ufffd\u06e0\b\ufffd\ufffdux\ufffd\u000e@\ufffd\ufffdZS*\ufffdX\ufffd\ufffd<\ufffdS\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5086,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffdj\ufffd\ufffd\u06e0\ufffd\ufffdux\ufffd@\ufffd\ufffdZS*\ufffdX\ufffd\ufffd<\ufffdS\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5086 \u00b7 (sonde \/ probe)",
"target_port_label": "5086 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5086,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u001d\ufffdj\ufffd\ufffd\u06e0\b\ufffd\ufffdux\ufffd\u000e@\ufffd\ufffdZS*\ufffdX\ufffd\ufffd<\ufffdS\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5086,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5086 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffdj\ufffd\ufffd\u06e0\ufffd\ufffdux\ufffd@\ufffd\ufffdZS*\ufffdX\ufffd\ufffd<\ufffdS\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5086 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5086"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
15/07/2026 04:43:46 UTC
TCP
5090 · TLS
Sonde TLS
tls probe · via TLS:5090 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5090
Chemin / cible
—
Service
TLS
Payload
� �d�#����FS�������S45l/�o�~:�� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d�#����FS�������S45l/�o�~:�� *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d�#����FS�������S45l/�o�~:�� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.911664116696124,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5090,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "dcce51e4237acdeef2839d72dbd11f4a1bed73d7",
"event_fingerprint": "53463fcaf846bde98ab1da331cf3b2b56d51957d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "96d1d70770e430229061ae5372fc3588",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5090,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd#\ufffd\ufffd\ufffd\ufffdFS\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffdS4\u00155l\/\ufffdo\ufffd~:\u0002\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd#\ufffd\ufffd\ufffd\ufffdFS\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffdS4\u00155l\/\ufffdo\ufffd~:\u0002\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd#\ufffd\ufffd\ufffd\ufffdFS\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffdS4\u00155l\/\ufffdo\ufffd~:\u0002\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "74447f489f8ebf112ef752ad45f2d82c23f2535a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd#\ufffd\ufffd\ufffd\ufffdFS\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffdS4\u00155l\/\ufffdo\ufffd~:\u0002\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5090,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffd#\ufffd\ufffd\ufffd\ufffdFS\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS45l\/\ufffdo\ufffd~:\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5090 \u00b7 (sonde \/ probe)",
"target_port_label": "5090 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5090,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd#\ufffd\ufffd\ufffd\ufffdFS\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffdS4\u00155l\/\ufffdo\ufffd~:\u0002\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5090,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5090 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffd#\ufffd\ufffd\ufffd\ufffdFS\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS45l\/\ufffdo\ufffd~:\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5090 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
15/07/2026 04:00:50 UTC
TCP
5087 · TLS
Sonde TLS
tls probe · via TLS:5087 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5087
Chemin / cible
—
Service
TLS
Payload
� �d���fnE�;m.�O� .x�D _kѮ�bk��8� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d���fnE�;m.�O� .x�D
_kѮ�bk��8� *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d���fnE�;m.�O� .x�D _kѮ�bk��8� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.981776405719641,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5087,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "112e30fe9acecb6ec77f4791cc7881baac05d3d7",
"event_fingerprint": "b22966ac81950774daeabbc63aca89552f25c75c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "fe08b7529180ddd9080022f85571c2bd",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5087,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u0019\ufffd\ufffdfnE\ufffd;m.\ufffdO\ufffd\u001d.x\ufffdD\n_k\u046e\ufffdbk\ufffd\ufffd8\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u0019\ufffd\ufffdfnE\ufffd;m.\ufffdO\ufffd\u001d.x\ufffdD\n_k\u046e\ufffdbk\ufffd\ufffd8\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u0019\ufffd\ufffdfnE\ufffd;m.\ufffdO\ufffd\u001d.x\ufffdD\n_k\u046e\ufffdbk\ufffd\ufffd8\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "57459c678bf813b234c4509856c74b06cb3705dd",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u0019\ufffd\ufffdfnE\ufffd;m.\ufffdO\ufffd\u001d.x\ufffdD\n_k\u046e\ufffdbk\ufffd\ufffd8\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5087,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd\ufffdfnE\ufffd;m.\ufffdO\ufffd.x\ufffdD\n_k\u046e\ufffdbk\ufffd\ufffd8\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5087 \u00b7 (sonde \/ probe)",
"target_port_label": "5087 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5087,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u0019\ufffd\ufffdfnE\ufffd;m.\ufffdO\ufffd\u001d.x\ufffdD\n_k\u046e\ufffdbk\ufffd\ufffd8\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5087,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd\ufffdfnE\ufffd;m.\ufffdO\ufffd.x\ufffdD\n_k\u046e\ufffdbk\ufffd\ufffd8\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5087 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
15/07/2026 02:46:58 UTC
TCP
5085 · TLS
Sonde TLS
tls probe · via TLS:5085 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5085
Chemin / cible
—
Service
TLS
Payload
� �d��+8�j����.��2�[gX=���%��� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d��+8�j����.��2�[gX=���%��� *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d��+8�j����.��2�[gX=���%��� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.923300614348844,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5085,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d1d7e527de6a8be6532dc9ac372bc6841225919f",
"event_fingerprint": "ba2fe596747a0ad766ae2ea045c3e4d63e77c33c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "12b407b17c6cac8803dc218e942eec94",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5085,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\b\ufffd+8\ufffdj\b\u0019\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd2\u0013\ufffd[gX=\ufffd\ufffd\ufffd%\ufffd\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\b\ufffd+8\ufffdj\b\u0019\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd2\u0013\ufffd[gX=\ufffd\ufffd\ufffd%\ufffd\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\b\ufffd+8\ufffdj\b\u0019\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd2\u0013\ufffd[gX=\ufffd\ufffd\ufffd%\ufffd\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e38982745e8c62a6fcda0e6ba80f7dddb2004004",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\b\ufffd+8\ufffdj\b\u0019\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd2\u0013\ufffd[gX=\ufffd\ufffd\ufffd%\ufffd\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5085,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd+8\ufffdj\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd2\ufffd[gX=\ufffd\ufffd\ufffd%\ufffd\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5085 \u00b7 (sonde \/ probe)",
"target_port_label": "5085 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5085,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\b\ufffd+8\ufffdj\b\u0019\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd2\u0013\ufffd[gX=\ufffd\ufffd\ufffd%\ufffd\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5085,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5085 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd+8\ufffdj\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd2\ufffd[gX=\ufffd\ufffd\ufffd%\ufffd\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5085 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5085"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
15/07/2026 01:40:43 UTC
TCP
5088 · TLS
Sonde TLS
tls probe · via TLS:5088 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5088
Chemin / cible
—
Service
TLS
Payload
� �d����X�ɤUb�'Z�(A�Qt��;ǵ *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d����X�ɤUb�'Z�(A�Qt��;ǵ *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d����X�ɤUb�'Z�(A�Qt��;ǵ *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.957900385282043,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5088,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d7f45c448c48a6f7a62082b3cdab9c7394f755e1",
"event_fingerprint": "78b4ea1e7b8c92e4ac2edd91d9679af77be2189b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "4ffff24ebf22c8b0c6c2f53467041187",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5088,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\u0015\ufffd\ufffdX\u0016\ufffd\u0264Ub\u0015\ufffd'Z\ue8dd\ufffd\u0016(A\ufffdQt\ufffd\ufffd;\u01f5\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\u0015\ufffd\ufffdX\u0016\ufffd\u0264Ub\u0015\ufffd'Z\ue8dd\ufffd\u0016(A\ufffdQt\ufffd\ufffd;\u01f5\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\u0015\ufffd\ufffdX\u0016\ufffd\u0264Ub\u0015\ufffd'Z\ue8dd\ufffd\u0016(A\ufffdQt\ufffd\ufffd;\u01f5\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b800ad07295ffe10e37cad1764318dc967ffce55",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\u0015\ufffd\ufffdX\u0016\ufffd\u0264Ub\u0015\ufffd'Z\ue8dd\ufffd\u0016(A\ufffdQt\ufffd\ufffd;\u01f5\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5088,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffdX\ufffd\u0264Ub\ufffd'Z\ue8dd\ufffd(A\ufffdQt\ufffd\ufffd;\u01f5*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5088 \u00b7 (sonde \/ probe)",
"target_port_label": "5088 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5088,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\u0015\ufffd\ufffdX\u0016\ufffd\u0264Ub\u0015\ufffd'Z\ue8dd\ufffd\u0016(A\ufffdQt\ufffd\ufffd;\u01f5\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5088,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5088 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffdX\ufffd\u0264Ub\ufffd'Z\ue8dd\ufffd(A\ufffdQt\ufffd\ufffd;\u01f5*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5088 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5088"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
15/07/2026 01:08:25 UTC
TCP
5084 · TLS
Sonde TLS
tls probe · via TLS:5084 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5084
Chemin / cible
—
Service
TLS
Payload
� �d��+X!��N���i;�q��.!�蝗�* *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d��+X!��N���i;�q��.!�蝗�* *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d��+X!��N���i;�q��.!�蝗�* *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.931131212263477,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5084,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5657c1b4aa6b70c27750070db67de0ab26fc96f1",
"event_fingerprint": "bf6e1493220e94333423e359ebd721835c1a5799",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "f936608d02dd29fab59c13512c7f1ebb",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5084,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd+\u0013X!\ufffd\ufffdN\ufffd\ufffd\ufffd\u0001i;\ufffdq\ufffd\u0018\ufffd\u000e.!\ufffd\u8757\ufffd*\u0011\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd+\u0013X!\ufffd\ufffdN\ufffd\ufffd\ufffd\u0001i;\ufffdq\ufffd\u0018\ufffd\u000e.!\ufffd\u8757\ufffd*\u0011\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd+\u0013X!\ufffd\ufffdN\ufffd\ufffd\ufffd\u0001i;\ufffdq\ufffd\u0018\ufffd\u000e.!\ufffd\u8757\ufffd*\u0011\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e0dd7e1cc555bdb52155ea4b97c151e3e08c9be7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd+\u0013X!\ufffd\ufffdN\ufffd\ufffd\ufffd\u0001i;\ufffdq\ufffd\u0018\ufffd\u000e.!\ufffd\u8757\ufffd*\u0011\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5084,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd+X!\ufffd\ufffdN\ufffd\ufffd\ufffdi;\ufffdq\ufffd\ufffd.!\ufffd\u8757\ufffd**\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5084 \u00b7 (sonde \/ probe)",
"target_port_label": "5084 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5084,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd+\u0013X!\ufffd\ufffdN\ufffd\ufffd\ufffd\u0001i;\ufffdq\ufffd\u0018\ufffd\u000e.!\ufffd\u8757\ufffd*\u0011\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5084,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5084 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd+X!\ufffd\ufffdN\ufffd\ufffd\ufffdi;\ufffdq\ufffd\ufffd.!\ufffd\u8757\ufffd**\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5084 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5084"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
14/07/2026 19:53:30 UTC
TCP
5089 · TLS
Sonde TLS
tls probe · via TLS:5089 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5089
Chemin / cible
—
Service
TLS
Payload
� �d���������r�=!aRm�0/�[w����q� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d���������r�=!aRm�0/�[w����q� *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d���������r�=!aRm�0/�[w����q� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 5.012322153989526,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5089,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c3a374a75873fa3ab0b54649de511cdc5930ad",
"event_fingerprint": "798f018065a5f979e6c9b19766ec0fb4ca8e0311",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "e408a29a3bb17381b2f0038d7625311b",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5089,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd\ufffd\u0010\ufffdr\ufffd=!aRm\ufffd0\/\ufffd[w\ufffd\ufffd\ufffd\u0011\ufffdq\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd\ufffd\u0010\ufffdr\ufffd=!aRm\ufffd0\/\ufffd[w\ufffd\ufffd\ufffd\u0011\ufffdq\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd\ufffd\u0010\ufffdr\ufffd=!aRm\ufffd0\/\ufffd[w\ufffd\ufffd\ufffd\u0011\ufffdq\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d7e1d6330a417b4e421c861c9b5e0c98ee53e3f3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd\ufffd\u0010\ufffdr\ufffd=!aRm\ufffd0\/\ufffd[w\ufffd\ufffd\ufffd\u0011\ufffdq\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5089,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd=!aRm\ufffd0\/\ufffd[w\ufffd\ufffd\ufffd\ufffdq\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5089 \u00b7 (sonde \/ probe)",
"target_port_label": "5089 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5089,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd\ufffd\u0010\ufffdr\ufffd=!aRm\ufffd0\/\ufffd[w\ufffd\ufffd\ufffd\u0011\ufffdq\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5089,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5089 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd=!aRm\ufffd0\/\ufffd[w\ufffd\ufffd\ufffd\ufffdq\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5089 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
14/07/2026 16:28:17 UTC
TCP
5081 · TLS
Sonde TLS
tls probe · via TLS:5081 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5081
Chemin / cible
—
Service
TLS
Payload
� �d�w���SX���P�֢�B�g��R�� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d�w���SX���P�֢�B�g��R�� *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d�w���SX���P�֢�B�g��R�� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.97997598050542,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5081,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "20e7c9891938ecc742976665720f48e9cacce874",
"event_fingerprint": "49dca7679e9d12586151029ddddd1c21fd9ca982",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "60d2bbe87b215e268df032172db2f4ce",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5081,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdw\ufffd\ufffd\ufffd\u0013SX\ufffd\u0011\ufffd\ufffd\u0014P\ufffd\u05a2\ufffdB\ufffdg\ufffd\ufffd\u0005R\u0602\ufffd\u0019\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdw\ufffd\ufffd\ufffd\u0013SX\ufffd\u0011\ufffd\ufffd\u0014P\ufffd\u05a2\ufffdB\ufffdg\ufffd\ufffd\u0005R\u0602\ufffd\u0019\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdw\ufffd\ufffd\ufffd\u0013SX\ufffd\u0011\ufffd\ufffd\u0014P\ufffd\u05a2\ufffdB\ufffdg\ufffd\ufffd\u0005R\u0602\ufffd\u0019\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "464971f0bffa7134503609c7d50cdd006e8e373e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdw\ufffd\ufffd\ufffd\u0013SX\ufffd\u0011\ufffd\ufffd\u0014P\ufffd\u05a2\ufffdB\ufffdg\ufffd\ufffd\u0005R\u0602\ufffd\u0019\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5081,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffdw\ufffd\ufffd\ufffdSX\ufffd\ufffd\ufffdP\ufffd\u05a2\ufffdB\ufffdg\ufffd\ufffdR\u0602\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5081 \u00b7 (sonde \/ probe)",
"target_port_label": "5081 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5081,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdw\ufffd\ufffd\ufffd\u0013SX\ufffd\u0011\ufffd\ufffd\u0014P\ufffd\u05a2\ufffdB\ufffdg\ufffd\ufffd\u0005R\u0602\ufffd\u0019\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5081,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5081 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffdw\ufffd\ufffd\ufffdSX\ufffd\ufffd\ufffdP\ufffd\u05a2\ufffdB\ufffdg\ufffd\ufffdR\u0602\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5081 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
14/07/2026 16:21:22 UTC
TCP
5083 · TLS
Sonde TLS
tls probe · via TLS:5083 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5083
Chemin / cible
—
Service
TLS
Payload
� �d�u�>կ��>2q�|�X zVؖ�ݬy&�� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d�u�>կ��>2q�|�X
zVؖ�ݬy&�� *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d�u�>կ��>2q�|�X zVؖ�ݬy&�� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.914830461302335,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5083,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7fd322fb301ba85e2d4af1974f0f467e95a7f03e",
"event_fingerprint": "c7a537a6caa6efe94db504cea18206aaa86897fd",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "9052ec46c8132151442932c460e82488",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5083,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdu\ufffd\u0018\u0005>\u056f\ufffd\ufffd>2q\ufffd|\ufffdX\nzV\u0017\u0005\u0616\ufffd\u076cy&\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdu\ufffd\u0018\u0005>\u056f\ufffd\ufffd>2q\ufffd|\ufffdX\nzV\u0017\u0005\u0616\ufffd\u076cy&\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdu\ufffd\u0018\u0005>\u056f\ufffd\ufffd>2q\ufffd|\ufffdX\nzV\u0017\u0005\u0616\ufffd\u076cy&\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f4f7f07e183e3623ad58ed6b496bb7066cb8c56f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdu\ufffd\u0018\u0005>\u056f\ufffd\ufffd>2q\ufffd|\ufffdX\nzV\u0017\u0005\u0616\ufffd\u076cy&\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5083,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffdu\ufffd>\u056f\ufffd\ufffd>2q\ufffd|\ufffdX\nzV\u0616\ufffd\u076cy&\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5083 \u00b7 (sonde \/ probe)",
"target_port_label": "5083 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5083,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdu\ufffd\u0018\u0005>\u056f\ufffd\ufffd>2q\ufffd|\ufffdX\nzV\u0017\u0005\u0616\ufffd\u076cy&\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5083,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5083 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffdu\ufffd>\u056f\ufffd\ufffd>2q\ufffd|\ufffdX\nzV\u0616\ufffd\u076cy&\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5083 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5083"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
14/07/2026 09:25:03 UTC
TCP
5099 · TLS
Sonde TLS
tls probe · via TLS:5099 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5099
Chemin / cible
—
Service
TLS
Payload
� �d�j���u�*6�(��J��2�4c?�Q#�� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d�j���u�*6�(��J��2�4c?�Q#�� *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d�j���u�*6�(��J��2�4c?�Q#�� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.918844682158001,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5099,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "26c4b88d439eaede969dd290360f6e7bf6c4107a",
"event_fingerprint": "314dd1fdcc62e31f0a9cd67b69eafba3db69878e",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "c61c5f9f9fd0efba883c07aa71e3aae1",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5099,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u0014j\u0010\ufffd\ufffd\ufffdu\ufffd*6\ufffd(\ufffd\ufffdJ\ufffd\ufffd2\ufffd4c?\u0010\u000e\ufffdQ#\ufffd\ufffd\u0002\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u0014j\u0010\ufffd\ufffd\ufffdu\ufffd*6\ufffd(\ufffd\ufffdJ\ufffd\ufffd2\ufffd4c?\u0010\u000e\ufffdQ#\ufffd\ufffd\u0002\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u0014j\u0010\ufffd\ufffd\ufffdu\ufffd*6\ufffd(\ufffd\ufffdJ\ufffd\ufffd2\ufffd4c?\u0010\u000e\ufffdQ#\ufffd\ufffd\u0002\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c19e19ea46a34f08b355c3843bf19b4cb390badf",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u0014j\u0010\ufffd\ufffd\ufffdu\ufffd*6\ufffd(\ufffd\ufffdJ\ufffd\ufffd2\ufffd4c?\u0010\u000e\ufffdQ#\ufffd\ufffd\u0002\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5099,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffdj\ufffd\ufffd\ufffdu\ufffd*6\ufffd(\ufffd\ufffdJ\ufffd\ufffd2\ufffd4c?\ufffdQ#\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5099 \u00b7 (sonde \/ probe)",
"target_port_label": "5099 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5099,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u0014j\u0010\ufffd\ufffd\ufffdu\ufffd*6\ufffd(\ufffd\ufffdJ\ufffd\ufffd2\ufffd4c?\u0010\u000e\ufffdQ#\ufffd\ufffd\u0002\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5099,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5099 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffdj\ufffd\ufffd\ufffdu\ufffd*6\ufffd(\ufffd\ufffdJ\ufffd\ufffd2\ufffd4c?\ufffdQ#\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5099 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5099"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
14/07/2026 06:19:46 UTC
TCP
5096 · TLS
Sonde TLS
tls probe · via TLS:5096 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5096
Chemin / cible
—
Service
TLS
Payload
� �d���@d}��y�)ς�3`PP�~�"UL���} *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d���@d}��y�)ς�3`PP�~�"UL���} *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d���@d}��y�)ς�3`PP�~�"UL���} *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.949430232235534,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5096,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "4277b9e6f6038d19ecb6eb2269ddede9c6c1b73b",
"event_fingerprint": "e18088823b50549090d37b4e9bdac616bbad1138",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "2e131814133a17cac55172b5e2a18444",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5096,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd@d}\ufffd\u0006\ufffdy\ufffd\u0004)\u03c2\ufffd3`P\u0011P\ufffd~\ufffd\"UL\ufffd\ufffd\ufffd}\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd@d}\ufffd\u0006\ufffdy\ufffd\u0004)\u03c2\ufffd3`P\u0011P\ufffd~\ufffd\"UL\ufffd\ufffd\ufffd}\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd@d}\ufffd\u0006\ufffdy\ufffd\u0004)\u03c2\ufffd3`P\u0011P\ufffd~\ufffd\"UL\ufffd\ufffd\ufffd}\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0821600728d8ab291b3489d99141b115483cff9c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd@d}\ufffd\u0006\ufffdy\ufffd\u0004)\u03c2\ufffd3`P\u0011P\ufffd~\ufffd\"UL\ufffd\ufffd\ufffd}\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5096,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd\ufffd@d}\ufffd\ufffdy\ufffd)\u03c2\ufffd3`PP\ufffd~\ufffd\"UL\ufffd\ufffd\ufffd}*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5096 \u00b7 (sonde \/ probe)",
"target_port_label": "5096 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5096,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd@d}\ufffd\u0006\ufffdy\ufffd\u0004)\u03c2\ufffd3`P\u0011P\ufffd~\ufffd\"UL\ufffd\ufffd\ufffd}\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5096,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5096 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd\ufffd@d}\ufffd\ufffdy\ufffd)\u03c2\ufffd3`PP\ufffd~\ufffd\"UL\ufffd\ufffd\ufffd}*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5096 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5096"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
14/07/2026 05:40:24 UTC
TCP
5097 · TLS
Sonde TLS
tls probe · via TLS:5097 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5097
Chemin / cible
—
Service
TLS
Payload
� �d���>��+��F~�G�J���JE�o��X ��� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d���>��+��F~�G�J���JE�o��X ��� *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d���>��+��F~�G�J���JE�o��X ��� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.945127684777388,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5097,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "139266584b58876d1806b29a41f50e81e6f20133",
"event_fingerprint": "8f67a0a8a479ae8f52231f5a8b1f584b06509481",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "b549f6dea3e8e7583f954c995c0c9b16",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5097,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd>\ufffd\ufffd+\u0011\ufffd\ufffdF~\ufffdG\ufffdJ\ufffd\ufffd\ufffdJE\ufffdo\ufffd\ufffdX\u0000\ufffd\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd>\ufffd\ufffd+\u0011\ufffd\ufffdF~\ufffdG\ufffdJ\ufffd\ufffd\ufffdJE\ufffdo\ufffd\ufffdX\u0000\ufffd\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd>\ufffd\ufffd+\u0011\ufffd\ufffdF~\ufffdG\ufffdJ\ufffd\ufffd\ufffdJE\ufffdo\ufffd\ufffdX\u0000\ufffd\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dcee194b79b2eee53c43823c06b6599fa04817cc",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd>\ufffd\ufffd+\u0011\ufffd\ufffdF~\ufffdG\ufffdJ\ufffd\ufffd\ufffdJE\ufffdo\ufffd\ufffdX\u0000\ufffd\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5097,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd\ufffd>\ufffd\ufffd+\ufffd\ufffdF~\ufffdG\ufffdJ\ufffd\ufffd\ufffdJE\ufffdo\ufffd\ufffdX\ufffd\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5097 \u00b7 (sonde \/ probe)",
"target_port_label": "5097 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5097,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd>\ufffd\ufffd+\u0011\ufffd\ufffdF~\ufffdG\ufffdJ\ufffd\ufffd\ufffdJE\ufffdo\ufffd\ufffdX\u0000\ufffd\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5097,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5097 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd\ufffd>\ufffd\ufffd+\ufffd\ufffdF~\ufffdG\ufffdJ\ufffd\ufffd\ufffdJE\ufffdo\ufffd\ufffdX\ufffd\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5097 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5097"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
13/07/2026 21:47:22 UTC
TCP
5094 · TLS
Sonde TLS
tls probe · via TLS:5094 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5094
Chemin / cible
—
Service
TLS
Payload
� �d�p�vr��9��'Y�ĭf��6HT"�V�`? *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d�p�vr��9��'Y�ĭf��6HT"�V�`? *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d�p�vr��9��'Y�ĭf��6HT"�V�`? *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 5.012322153989525,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5094,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "176d2419380511de7202a65ddb83ae628e1f0759",
"event_fingerprint": "4cadcc87a2b757a7519273f465b8afdd4c5dd1bc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "dbadd7592832342179e18f8f1e674f59",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5094,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdp\ufffdvr\ufffd\ufffd9\ufffd\ufffd'Y\ufffd\u012df\ufffd\ufffd\u00156H\u0019T\u0004\"\ufffdV\ufffd`?\u0011\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdp\ufffdvr\ufffd\ufffd9\ufffd\ufffd'Y\ufffd\u012df\ufffd\ufffd\u00156H\u0019T\u0004\"\ufffdV\ufffd`?\u0011\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdp\ufffdvr\ufffd\ufffd9\ufffd\ufffd'Y\ufffd\u012df\ufffd\ufffd\u00156H\u0019T\u0004\"\ufffdV\ufffd`?\u0011\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f2a97c55254ad82226d82c8583d978fb9173041",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdp\ufffdvr\ufffd\ufffd9\ufffd\ufffd'Y\ufffd\u012df\ufffd\ufffd\u00156H\u0019T\u0004\"\ufffdV\ufffd`?\u0011\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5094,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffdp\ufffdvr\ufffd\ufffd9\ufffd\ufffd'Y\ufffd\u012df\ufffd\ufffd6HT\"\ufffdV\ufffd`?*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5094 \u00b7 (sonde \/ probe)",
"target_port_label": "5094 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5094,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdp\ufffdvr\ufffd\ufffd9\ufffd\ufffd'Y\ufffd\u012df\ufffd\ufffd\u00156H\u0019T\u0004\"\ufffdV\ufffd`?\u0011\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5094,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5094 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffdp\ufffdvr\ufffd\ufffd9\ufffd\ufffd'Y\ufffd\u012df\ufffd\ufffd6HT\"\ufffdV\ufffd`?*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5094 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5094"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
13/07/2026 20:51:42 UTC
TCP
5095 · TLS
Sonde TLS
tls probe · via TLS:5095 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5095
Chemin / cible
—
Service
TLS
Payload
� �d�cٺR���,�U�b���A#!e'�;�w@YWȃ *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d�cٺR���,�U�b���A#!e'�;�w@YWȃ *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d�cٺR���,�U�b���A#!e'�;�w@YWȃ *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.985111269635784,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5095,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "4d9c473ba493fa60c91c9514244a1c47bf70f85b",
"event_fingerprint": "da6a9a28838f439f81ab711ffd12a7ff58b95fde",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "dfceda1d669ff2f7885e33a98e46c3ef",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5095,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdc\u067aR\ufffd\ufffd\ufffd,\ufffdU\ufffdb\u000f\ufffd\ufffd\ufffdA#!e'\ufffd;\ufffdw@YW\u0203\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdc\u067aR\ufffd\ufffd\ufffd,\ufffdU\ufffdb\u000f\ufffd\ufffd\ufffdA#!e'\ufffd;\ufffdw@YW\u0203\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdc\u067aR\ufffd\ufffd\ufffd,\ufffdU\ufffdb\u000f\ufffd\ufffd\ufffdA#!e'\ufffd;\ufffdw@YW\u0203\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "14929d26312f91cb64516e9aed004ab636a005e3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdc\u067aR\ufffd\ufffd\ufffd,\ufffdU\ufffdb\u000f\ufffd\ufffd\ufffdA#!e'\ufffd;\ufffdw@YW\u0203\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5095,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffdc\u067aR\ufffd\ufffd\ufffd,\ufffdU\ufffdb\ufffd\ufffd\ufffdA#!e'\ufffd;\ufffdw@YW\u0203*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5095 \u00b7 (sonde \/ probe)",
"target_port_label": "5095 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5095,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdc\u067aR\ufffd\ufffd\ufffd,\ufffdU\ufffdb\u000f\ufffd\ufffd\ufffdA#!e'\ufffd;\ufffdw@YW\u0203\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5095,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5095 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffdc\u067aR\ufffd\ufffd\ufffd,\ufffdU\ufffdb\ufffd\ufffd\ufffdA#!e'\ufffd;\ufffdw@YW\u0203*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5095 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5095"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
13/07/2026 20:08:03 UTC
TCP
5098 · TLS
Sonde TLS
tls probe · via TLS:5098 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5098
Chemin / cible
—
Service
TLS
Payload
� �d�Y��x���%L���b��WY/l��"�� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d�Y��x���%L���b��WY/l��"�� *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d�Y��x���%L���b��WY/l��"�� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.928889075714081,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5098,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "945f19ea50482a43489c40bcbe5365e89ea180f2",
"event_fingerprint": "79cb536206d24ba9e409e2b2010c1f22a9f64c1c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "e70b766b4ab60e49d47b159b67005490",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5098,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdY\ufffd\ufffdx\ufffd\ufffd\ufffd%L\ufffd\ufffd\ufffdb\ufffd\ufffd\u0012W\b\u0014\u0004\u0011Y\/l\ufffd\ufffd\"\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdY\ufffd\ufffdx\ufffd\ufffd\ufffd%L\ufffd\ufffd\ufffdb\ufffd\ufffd\u0012W\b\u0014\u0004\u0011Y\/l\ufffd\ufffd\"\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdY\ufffd\ufffdx\ufffd\ufffd\ufffd%L\ufffd\ufffd\ufffdb\ufffd\ufffd\u0012W\b\u0014\u0004\u0011Y\/l\ufffd\ufffd\"\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "564e2f6677f02340a0b46c14cf02046489d8cd50",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdY\ufffd\ufffdx\ufffd\ufffd\ufffd%L\ufffd\ufffd\ufffdb\ufffd\ufffd\u0012W\b\u0014\u0004\u0011Y\/l\ufffd\ufffd\"\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5098,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffdY\ufffd\ufffdx\ufffd\ufffd\ufffd%L\ufffd\ufffd\ufffdb\ufffd\ufffdWY\/l\ufffd\ufffd\"\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5098 \u00b7 (sonde \/ probe)",
"target_port_label": "5098 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5098,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdY\ufffd\ufffdx\ufffd\ufffd\ufffd%L\ufffd\ufffd\ufffdb\ufffd\ufffd\u0012W\b\u0014\u0004\u0011Y\/l\ufffd\ufffd\"\ufffd\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5098,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5098 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffdY\ufffd\ufffdx\ufffd\ufffd\ufffd%L\ufffd\ufffd\ufffdb\ufffd\ufffdWY\/l\ufffd\ufffd\"\ufffd\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5098 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
13/07/2026 19:14:59 UTC
TCP
5092 · TLS
Sonde TLS
tls probe · via TLS:5092 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5092
Chemin / cible
—
Service
TLS
Payload
� �d�M-�ߙ��a ^. FdQ���4�Ʊ5ne:{P� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d�M-�ߙ��a ^. FdQ���4�Ʊ5ne:{P� *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d�M-�ߙ��a ^. FdQ���4�Ʊ5ne:{P� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 5.003852000943018,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5092,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c47f2c04d4d43bb7fad36372e946af6f63eaef38",
"event_fingerprint": "5ebd5f4ccc7e177260c1b2524b71cd170f1fde7f",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "e21ae26572eeb14adbf33fea2e347867",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5092,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdM-\ufffd\u07d9\ufffd\ufffda\t^.\u001eFdQ\ufffd\ufffd\ufffd4\ufffd\u01b15\u001bne:{P\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdM-\ufffd\u07d9\ufffd\ufffda\t^.\u001eFdQ\ufffd\ufffd\ufffd4\ufffd\u01b15\u001bne:{P\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdM-\ufffd\u07d9\ufffd\ufffda\t^.\u001eFdQ\ufffd\ufffd\ufffd4\ufffd\u01b15\u001bne:{P\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ac339055d10a912049dafa99c7e05bee25dbc0ad",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdM-\ufffd\u07d9\ufffd\ufffda\t^.\u001eFdQ\ufffd\ufffd\ufffd4\ufffd\u01b15\u001bne:{P\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5092,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffdM-\ufffd\u07d9\ufffd\ufffda\t^.FdQ\ufffd\ufffd\ufffd4\ufffd\u01b15ne:{P\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5092 \u00b7 (sonde \/ probe)",
"target_port_label": "5092 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5092,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffdM-\ufffd\u07d9\ufffd\ufffda\t^.\u001eFdQ\ufffd\ufffd\ufffd4\ufffd\u01b15\u001bne:{P\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5092,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5092 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffdM-\ufffd\u07d9\ufffd\ufffda\t^.FdQ\ufffd\ufffd\ufffd4\ufffd\u01b15ne:{P\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5092 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5092"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
13/07/2026 16:31:14 UTC
TCP
5091 · TLS
Sonde TLS
tls probe · via TLS:5091 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5091
Chemin / cible
—
Service
TLS
Payload
� �d�&�]g�u�<�$���t�6ݕ@_ �wq5�]�C� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d�&�]g�u�<�$���t�6ݕ@_ �wq5�]�C� *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d�&�]g�u�<�$���t�6ݕ@_ �wq5�]�C� *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.990246558766148,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5091,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "61654521527d7155a1eb85fa8e176aff5b3046ff",
"event_fingerprint": "48241a2c9982ace73acc0668431c846ed677ff99",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "03c60870fcd72bccd03f414872da7192",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5091,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd&\ufffd]g\ufffdu\ufffd<\ufffd$\ufffd\ufffd\ufffdt\ufffd6\u0755@_\f\ufffdwq5\ufffd]\ufffdC\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd&\ufffd]g\ufffdu\ufffd<\ufffd$\ufffd\ufffd\ufffdt\ufffd6\u0755@_\f\ufffdwq5\ufffd]\ufffdC\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd&\ufffd]g\ufffdu\ufffd<\ufffd$\ufffd\ufffd\ufffdt\ufffd6\u0755@_\f\ufffdwq5\ufffd]\ufffdC\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6d60dd2960a9864e23e64e5f1aa6d393f95c0cde",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd&\ufffd]g\ufffdu\ufffd<\ufffd$\ufffd\ufffd\ufffdt\ufffd6\u0755@_\f\ufffdwq5\ufffd]\ufffdC\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5091,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffd&\ufffd]g\ufffdu\ufffd<\ufffd$\ufffd\ufffd\ufffdt\ufffd6\u0755@_\ufffdwq5\ufffd]\ufffdC\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5091 \u00b7 (sonde \/ probe)",
"target_port_label": "5091 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5091,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd&\ufffd]g\ufffdu\ufffd<\ufffd$\ufffd\ufffd\ufffdt\ufffd6\u0755@_\f\ufffdwq5\ufffd]\ufffdC\ufffd\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5091,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5091 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffd&\ufffd]g\ufffdu\ufffd<\ufffd$\ufffd\ufffd\ufffdt\ufffd6\u0755@_\ufffdwq5\ufffd]\ufffdC\ufffd*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5091 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5091"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
13/07/2026 15:22:10 UTC
TCP
5093 · TLS
Sonde TLS
tls probe · via TLS:5093 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5093
Chemin / cible
—
Service
TLS
Payload
� �d��D�na�'.���I<_Z��S�!�N���V *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d��D�na�'.���I<_Z��S�!�N���V *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d��D�na�'.���I<_Z��S�!�N���V *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.9139249196581645,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5093,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "e2423bfc46e9cf7597280bf5cc2ed5849f76f925",
"event_fingerprint": "55cd40267c0d357fd0294a4aa6c9cbc5214b9630",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "90606252f6441e94b5d862a1c2449cb1",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5093,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u0016\ufffdD\ufffdna\ufffd'.\ufffd\ufffd\ufffdI<_Z\ufffd\u0003\ufffdS\ufffd\u0003\u0018!\ufffdN\ufffd\ufffd\ufffdV\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u0016\ufffdD\ufffdna\ufffd'.\ufffd\ufffd\ufffdI<_Z\ufffd\u0003\ufffdS\ufffd\u0003\u0018!\ufffdN\ufffd\ufffd\ufffdV\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u0016\ufffdD\ufffdna\ufffd'.\ufffd\ufffd\ufffdI<_Z\ufffd\u0003\ufffdS\ufffd\u0003\u0018!\ufffdN\ufffd\ufffd\ufffdV\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "71f3cdd00a2ac4fdd81b1710ee745e9814756d26",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u0016\ufffdD\ufffdna\ufffd'.\ufffd\ufffd\ufffdI<_Z\ufffd\u0003\ufffdS\ufffd\u0003\u0018!\ufffdN\ufffd\ufffd\ufffdV\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5093,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffdD\ufffdna\ufffd'.\ufffd\ufffd\ufffdI<_Z\ufffd\ufffdS\ufffd!\ufffdN\ufffd\ufffd\ufffdV*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5093 \u00b7 (sonde \/ probe)",
"target_port_label": "5093 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5093,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\u0016\ufffdD\ufffdna\ufffd'.\ufffd\ufffd\ufffdI<_Z\ufffd\u0003\ufffdS\ufffd\u0003\u0018!\ufffdN\ufffd\ufffd\ufffdV\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5093,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5093 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffdD\ufffdna\ufffd'.\ufffd\ufffd\ufffdI<_Z\ufffd\ufffdS\ufffd!\ufffdN\ufffd\ufffd\ufffdV*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5093 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5093"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
13/07/2026 11:53:56 UTC
TCP
5100 · TLS
Sonde TLS
tls probe · via TLS:5100 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12f54a3f91dc7ba
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5100
Chemin / cible
—
Service
TLS
Payload
� �d���*���G���} O��S�y�b"k *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d���*���G���} O��S�y�b"k *�,�+�0�/ � ��$�#�(�'�
� �� � � = < 5 /
7
Requête brute (extrait)
� �d���*���G���} O��S�y�b"k *�,�+�0�/ � ��$�#�(�'� � �� � � = < 5 / 7 # �
Meta JSON brut
{
"tls_ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 5,
"bytes_in": 147,
"payload_entropy": 4.95902145355674,
"port_category": "registered",
"org": "ReliableSite.Net LLC",
"service": "tls",
"app_proto": "tls",
"asn": 23470,
"country": "PH",
"dst_port": 5100,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "3062ed9f15d4f0b64639410954e0ee1a189f9768",
"event_fingerprint": "12aeda9dd4c55b0b2a275fcf25c281db39353906",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "PH",
"asn": 23470,
"org": "ReliableSite.Net LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"payload_hash": "44bf14c7c7d1daded0b6287c8fb26860",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0",
"tls_ja4_hash": "2551b97e3a9c0ebf7b66f183c56033e1",
"tls_ja4": "t13d0121_f338b42a8f9d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 21,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5100,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffdG\ufffd\u0016\u0007\ufffd\u0096\ufffd}\u001eO\u0002\u0001\ufffd\ufffd\u0019S\u000f\ufffdy\ufffdb\"k\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffdG\ufffd\u0016\u0007\ufffd\u0096\ufffd}\u001eO\u0002\u0001\ufffd\ufffd\u0019S\u000f\ufffdy\ufffdb\"k\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003\u0002\u0002\u0006\u0001\u0006\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffdG\ufffd\u0016\u0007\ufffd\u0096\ufffd}\u001eO\u0002\u0001\ufffd\ufffd\u0019S\u000f\ufffdy\ufffdb\"k\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "abe780dda686653f28fda977020cd6808c8e4ec9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffdG\ufffd\u0016\u0007\ufffd\u0096\ufffd}\u001eO\u0002\u0001\ufffd\ufffd\u0019S\u000f\ufffdy\ufffdb\"k\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5100,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffdG\ufffd\ufffd\u0096\ufffd}O\ufffd\ufffdS\ufffdy\ufffdb\"k*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"attack_vector": "tls probe \u00b7 via TLS:5100 \u00b7 (sonde \/ probe)",
"target_port_label": "5100 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5100,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffdG\ufffd\u0016\u0007\ufffd\u0096\ufffd}\u001eO\u0002\u0001\ufffd\ufffd\u0019S\u000f\ufffdy\ufffdb\"k\u0000\u0000*\ufffd,\ufffd+\ufffd0\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\n\u0001\u0000\u00007\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0014\u0000\u0012\u0004\u0001\u0005\u0001\u0002\u0001\u0004\u0003\u0005\u0003\u0002\u0003",
"tls_ja3": "c12f54a3f91dc7bafd92cb59fe009a35",
"tls_ja4": "2551b97e3a9c0ebf7b66f183c56033e1",
"port": 5100,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:5100 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffdG\ufffd\ufffd\u0096\ufffd}O\ufffd\ufffdS\ufffdy\ufffdb\"k*\ufffd,\ufffd+\ufffd0\ufffd\/\ufffd\ufffd\ufffd$\ufffd#\ufffd(\ufffd'\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd=<5\/\n7",
"target_port_label": "5100 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5100"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}