Détails IP 173.211.38.224

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

xss_attack

Comparaison ASN / FAI

ASN 21769 · 173.211.0.0/17 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 4 événements sur la période pour cette IP.

173.211.49.237 Cross-site scripting 18/07/2026 19:57 UTC
172.84.126.17 Sonde Elasticsearch 18/07/2026 18:12 UTC
184.174.15.194 consul probe 18/07/2026 18:08 UTC
67.219.16.139 Sonde Elasticsearch 18/07/2026 17:49 UTC
172.84.102.187 couchdb probe 18/07/2026 15:56 UTC
185.206.221.233 Cross-site scripting 18/07/2026 14:49 UTC
204.14.107.141 Sonde API Docker 18/07/2026 13:50 UTC
173.211.48.191 Cross-site scripting 18/07/2026 10:33 UTC

IPs apparentées

Même FAI Colocation America Corporation — corrélation indicative.

173.211.49.237 Cross-site scripting
172.84.126.17 Sonde Elasticsearch
184.174.15.194 consul probe
67.219.16.139 Sonde Elasticsearch
172.84.102.187 couchdb probe

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 3 KIBANA TCP 1

HTTP

3

KIBANA

1

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

4 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
18/07/2026 13:39:34 UTC	TCP	5601 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5601 · (tentative d'exploit) · → /api/console/proxy	—	Élevé · 70
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole POST /api/console/proxy UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 35 Recommandation Investiguer Tags 950325:rce-0 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP POST /api/console/proxy TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 5601 Chemin / cible /api/console/proxy Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Élevé · 70 Confiance : Confiance 100 % — 6 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api/console/proxy?path=_search&method=POST HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 k8s-api webshell-param-file Payload (extrait) POST /api/console/proxy?path=_search&method=POST HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win6 Requête brute (extrait) POST /api/console/proxy?path=_search&method=POST HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Content-Length: 212 Accept: / Accept-Encoding Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322", "emulator_response_len": 163, "http_header_count": 14, "http_query_params": 2, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533", "http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c", "http_target_hash": "bd77752abd24d5185331e17af0baa7bbcaf39172", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 783, "payload_entropy": 5.553515036260032, "port_category": "registered", "org": "Colocation America Corporation", "service": "http", "app_proto": "http", "asn": 21769, "country": "US", "dst_port": 5601, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 70, "tag_count": 10, "anomaly_count": 0, "campaign_key": "7fd9345c830deaf3c58799c199c5674a9c56b144", "event_fingerprint": "a70eeed4cf1cde2181a050dabb90fd74798d5104", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 70 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 21769, "org": "Colocation America Corporation", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3", "payload_hash": "b0be7ff05938e7f6684e7b95546d90f4", "path_pattern_hash": "2257749ad5213b22dc528ffa1cca7545" }, "target_context": { "dst_port": 5601, "service": "http", "service_name": "http", "risk_score": 70 }, "method": "POST", "path": "\/api\/console\/proxy", "query_string": "path=_search&method=POST", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950630:webshell-param-file" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api", "webshell-param-file" ], "request_line": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1", "payload_snippet": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "evidence": { "method": "POST", "path": "\/api\/console\/proxy", "query_string": "path=_search&method=POST", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950630:webshell-param-file" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api", "webshell-param-file" ], "request_line": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1", "request_sample": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nContent-Length: 212\r\nAccept: \/\r\nAccept-Encoding", "payload_snippet": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b2f076d3e8fe7f226fa53b27f7d7b8d98f3661d1", "protocol_details": { "http_method": "POST", "http_path": "\/api\/console\/proxy", "request_line": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "attack_vector": "config file probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/console\/proxy", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 70 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 70, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5601, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/api\/console\/proxy", "request_line": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/console\/proxy", "evidence_snippet": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5601" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950630:webshell-param-file", "http_probe_api", "http_sensitive_path", "http_suspicious_params", "net_web_probe" ] }
18/07/2026 13:39:34 UTC	TCP	5601 · KIBANA	kibana	kibana probe kibana probe · via KIBANA:5601 · (sonde / probe)	—	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur KIBANA WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5601 Chemin / cible — Service KIBANA Pourquoi cette classification : Type « kibana_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 24 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322", "emulator_response_len": 163, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Colocation America Corporation", "service": "kibana", "app_proto": "kibana", "asn": 21769, "country": "US", "dst_port": 5601, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 24, "tag_count": 2, "anomaly_count": 0, "campaign_key": "9b8c7063184af590e074e6367a10d303c5aaba60", "event_fingerprint": "2e1f529c61b64068b719daaa760380b1c25ad6a1", "classification_reason": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 24, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "kibana", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 21769, "org": "Colocation America Corporation", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "0f790dc1ffcf37cb597b3d4bfc47e511" }, "target_context": { "dst_port": 5601, "service": "kibana", "service_name": "kibana", "risk_score": 24 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "49e0018bd203e5249266db0a881a3d5640577140", "protocol_details": { "port": 5601, "service": "kibana", "service_label_fr": "KIBANA" }, "attack_vector": "kibana probe \u00b7 via KIBANA:5601 \u00b7 (sonde \/ probe)", "target_port_label": "5601 \u00b7 KIBANA", "emulator_service": "kibana", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 24, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": "kibana", "service_label_fr": "KIBANA", "dst_port": 5601, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kibana", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "port": 5601, "service": "kibana", "service_label_fr": "KIBANA" }, "attack_vector": "kibana probe \u00b7 via KIBANA:5601 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "5601 \u00b7 KIBANA", "emulator_service": "kibana", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kibana", "service_banner": "honeypot-kibana", "service_os": "linux", "dst_port": "5601" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kibana" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "kibana_emulated", "net_kibana_probe" ] }
18/07/2026 13:39:20 UTC	TCP	5601 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5601 · (tentative d'exploit) · → /api/console/proxy	—	Élevé · 70
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /api/console/proxy UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/2… Émulateur HTTP WAF 35 Recommandation Investiguer Tags 950325:rce-0 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /api/console/proxy TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5601 Chemin / cible /api/console/proxy Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Élevé · 70 Confiance : Confiance 100 % — 6 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 ES cat indices Ligne de requête `GET /api/console/proxy?path=_cat/indices&method=GET HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0 Règles WAF rce-0 nosqli-3 k8s-api webshell-param-file Payload (extrait) GET /api/console/proxy?path=_cat/indices&method=GET HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (Macintosh; Intel M Requête brute (extrait) GET /api/console/proxy?path=_cat/indices&method=GET HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif, Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322", "emulator_response_len": 163, "http_header_count": 9, "http_query_params": 2, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "1717c91603374a2713abf37a2bbc8366d67dc83b", "http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c", "http_target_hash": "f07df4be4984e2d1affe162d58bbf9a02850d0e5", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 459, "payload_entropy": 5.408568064027229, "port_category": "registered", "org": "Colocation America Corporation", "service": "http", "app_proto": "http", "asn": 21769, "country": "US", "dst_port": 5601, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 70, "tag_count": 10, "anomaly_count": 0, "campaign_key": "7fd9345c830deaf3c58799c199c5674a9c56b144", "event_fingerprint": "c0c7c6e2c8eda6df4bf00848f645c8d40cb7ec2d", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0284", "pat-0342" ], "matched_pattern_names": [ "CRS 941130", "ES cat indices" ], "pattern_ids": [ "pat-0284", "pat-0342" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 70 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 21769, "org": "Colocation America Corporation", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "227d0b9a32e1493feff52e0e93f6dec6", "payload_hash": "886d2efeb27b72170ca1982686a4fb5c", "path_pattern_hash": "2257749ad5213b22dc528ffa1cca7545" }, "target_context": { "dst_port": 5601, "service": "http", "service_name": "http", "risk_score": 70 }, "method": "GET", "path": "\/api\/console\/proxy", "query_string": "path=_cat\/indices&method=GET", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101 Firefox\/136.0", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950630:webshell-param-file" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api", "webshell-param-file" ], "request_line": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1", "payload_snippet": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "evidence": { "method": "GET", "path": "\/api\/console\/proxy", "query_string": "path=_cat\/indices&method=GET", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101 Firefox\/136.0", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950630:webshell-param-file" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api", "webshell-param-file" ], "request_line": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1", "request_sample": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101 Firefox\/136.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,", "payload_snippet": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e908f7501c39bd0997a107f5a79c96f89f4116de", "protocol_details": { "http_method": "GET", "http_path": "\/api\/console\/proxy", "request_line": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101 Firefox\/136.0", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "attack_vector": "config file probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/console\/proxy", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 70 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 70, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5601, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/api\/console\/proxy", "request_line": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101 Firefox\/136.0", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/console\/proxy", "evidence_snippet": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5601" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950630:webshell-param-file", "http_probe_api", "http_sensitive_path", "http_suspicious_params", "net_web_probe" ] }
18/07/2026 13:38:55 UTC	TCP	5601 · HTTP	http	Cross-site scripting xss attack · via HTTP:5601 · (tentative d'exploit) · → /api/status	—	Moyen · 62
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /api/status UA Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefo… Émulateur HTTP WAF 23 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950600:k8s-api Cible HTTP GET /api/status TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5601 Chemin / cible /api/status Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 62 Confiance : Confiance 59 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /api/status HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0 Règles WAF rce-0 nosqli-3 k8s-api Payload (extrait) GET /api/status HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/13 Requête brute (extrait) GET /api/status HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, defla Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322", "emulator_response_len": 163, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "61a68d8ae82bc8425114abf48390d06cae6524df", "http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c", "http_target_hash": "7fbc29f027b400f6512972fd492109517e235ed4", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 409, "payload_entropy": 5.414089850711164, "port_category": "registered", "org": "Colocation America Corporation", "service": "http", "app_proto": "http", "asn": 21769, "country": "US", "dst_port": 5601, "risk_waf": 100, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.5, "risk_breakdown": { "waf": 100, "classification": 68, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 62, "tag_count": 6, "anomaly_count": 0, "campaign_key": "59eb7b692d13ad334aed59d05b7e566aa16a5090", "event_fingerprint": "250e2065f3e1c173372f05dd39ab0ee341825b3b", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 100, "classification": 68, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 62 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 21769, "org": "Colocation America Corporation", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1846ec21f37e27db5dcc081ead338b2b", "payload_hash": "00f661b4c737b65d07cefd3c36913fa0", "path_pattern_hash": "0ea44bf547cfd3e93a42dabfc2f1808a" }, "target_context": { "dst_port": 5601, "service": "http", "service_name": "http", "risk_score": 62 }, "payload_preview": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/13", "method": "GET", "path": "\/api\/status", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/status HTTP\/1.1", "request_sample": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r\nAccept-Encoding: gzip, defla", "payload_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/13", "evidence": { "method": "GET", "path": "\/api\/status", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/status HTTP\/1.1", "request_sample": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r\nAccept-Encoding: gzip, defla", "payload_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/13", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "50494fecd339735fd141e737e1ac09c3ca8b87cd", "protocol_details": { "http_method": "GET", "http_path": "\/api\/status", "request_line": "GET \/api\/status HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/13", "attack_vector": "xss attack \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/status", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP", "confidence_pct": 59, "confidence_breakdown": { "waf": 100, "classification": 68, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 62 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 62, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5601, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/api\/status", "request_line": "GET \/api\/status HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/status", "evidence_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/13", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5601" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "http_probe_api", "net_web_probe" ] }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

173.211.38.224

Profil de menace

Pourquoi listée

Comparaison ASN / FAI

Activité multi-protocole

Géolocalisation

FAI / réseau

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence