Renseignement sur les menaces

Pays-Bas

185.242.3.121

FAI Netiface America, Inc. Première vue 05/07/2026 08:30 UTC Dernière vue 21/07/2026 18:57 UTC Risque Moyen

Période analysée : 2026-06-22 → 2026-07-22

Activité suspecte · risque 40/100

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 46/100 Moyen

Première observation 05/07/2026 08:30 UTC

Dernière observation 21/07/2026 18:57 UTC

Événements (période) 99

MITRE ATT&CK principal TA0007 81 occurrences

Activité suspecte · risque 40/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « web_probe » (signaux protocolaires) · confiance 77%

Confiance 77 % — Score WAF 8

Comparaison ASN / FAI

ASN 401626 · 185.242.3.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 99 événements sur la période pour cette IP.

185.242.3.195 Sonde SSH 22/07/2026 03:18 UTC
64.89.163.132 Protocole wire MongoDB 22/07/2026 02:30 UTC
64.89.163.148 Sonde MySQL 22/07/2026 01:29 UTC
64.89.163.85 Protocole wire MongoDB 21/07/2026 07:17 UTC
64.89.163.145 Sonde port 3307/TCP 21/07/2026 02:59 UTC
64.89.163.152 Sonde MySQL 21/07/2026 02:15 UTC
64.89.163.131 Protocole wire MongoDB 20/07/2026 20:38 UTC
64.89.163.235 Sonde HTTP 20/07/2026 10:02 UTC

Événements (filtres)

Première observation

05/07/2026 08:30 UTC

Dernière observation

21/07/2026 18:57 UTC

Dernière activité (filtres)

21/07/2026 18:57 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 61 HDFS NAMENODE TCP 16 HTTP ALT 8082 TCP 3 SPLUNK HEC TCP 1

HTTP

HDFS NAMENODE

HTTP ALT 8082

SPLUNK HEC

Géolocalisation

Origine réseau déclarée

Pays-Bas unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Netiface America, Inc. 0 Port 8090 web_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80

Détails protocole

Méthode: CONNECT
Chemin: 185.242.3.121:80

Aperçu payload

CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic c2FtdXJheTohUUFaQFdTWDNlZGM=

Port / service

8090 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 77 % — Score WAF 8

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Confiance

77%

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

99 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

99 événement(s) — page 2/2

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
11/07/2026 14:28:40 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic emhhbmc6emhhbmc= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.0916297433607935, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ba1705e9db8bc9788943b68df8da9ea0", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic emhhbmc6emhhbmc=\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic emhhbmc6emhhbmc=\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic emhhbmc6emhhbmc=", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic emhhbmc6emhhbmc=\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic emhhbmc6emhhbmc=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38d3a969b89258fa71d842ff799cbfd333389d54", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic emhhbmc6emhhbmc=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic emhhbmc6emhhbmc=", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
11/07/2026 14:28:39 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic MjU4OjI1OA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 102, "payload_entropy": 5.071442744460245, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0380262511f0aaaba8943f1f7b05c07f", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MjU4OjI1OA==\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MjU4OjI1OA==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MjU4OjI1OA==", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MjU4OjI1OA==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MjU4OjI1OA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "07a183997a8a251041bb70e8df08f6ef1b0fb1e1", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MjU4OjI1OA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MjU4OjI1OA==", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
11/07/2026 14:28:24 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic MTIzNDU6MTIzNDU= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.114226352009792, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2ca648fb819a49f819930c77125e5b9b", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e50e9e28fdc28bb2076d8f08c67269673666384f", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 72 }
11/07/2026 14:28:17 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic YWRtaW46NTQzMjE= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.160025908351992, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ae7809653ecf851f86ebc754a2089220", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46NTQzMjE=\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46NTQzMjE=\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46NTQzMjE=", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46NTQzMjE=\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46NTQzMjE=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2946f75d06730e8f32e95293f6ca1bb8cd04b553", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46NTQzMjE=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46NTQzMjE=", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
11/07/2026 14:28:10 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic MTIzOjEyMw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 102, "payload_entropy": 5.097062137127766, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c92293f29d1609e29bc5ade356bb014b", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzOjEyMw==", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzOjEyMw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "04f82e45c01fd3e1c14b18b727996bee82ea5d03", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzOjEyMw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzOjEyMw==", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
11/07/2026 14:28:02 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic dXNlcjE6cGFzczE= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.169513065188773, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c72664fc9a8d1ce810ecc34658c03487", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2fea4cb5be7f4018d2111adbce855f5c45b399a6", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
11/07/2026 14:27:55 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 35, "payload_entropy": 4.114718016821338, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2497abaf97a20697197eadf8a6e41f27", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "da282511b5468ec87f54368ce6b761feca94f790", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 72 }
11/07/2026 14:10:17 UTC	TCP	1221 · HTTP	http	slowloris slowloris · via HTTP:1221 · (tentative d'exploit) · → 185.242.3.121:80	Élevée	Faible · 28
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_slowloris Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 1221 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « slowloris » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 28 Confiance : Confiance 0 % — 4 signal(aux) capteur Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic amhsZWU6amhsZWUxMjM= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.202048641953147, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 1221, "risk_waf": 8, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 28, "tag_count": 4, "anomaly_count": 0, "campaign_key": "211ed18c164a3a9c8bd82fa0148815c86d5b49e4", "event_fingerprint": "172d5ab6394ec5274eb93ac5d2dc1797dd3d5220", "classification_reason": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0463" ], "matched_pattern_names": [ "Cred Basic auth spray" ], "pattern_ids": [ "pat-0463" ], "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 28, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d3ab776224f1c292c87e566efc5ac474", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "target_context": { "dst_port": 1221, "service": "http", "service_name": "http", "risk_score": 28 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic amhsZWU6amhsZWUxMjM=\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic amhsZWU6amhsZWUxMjM=\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic amhsZWU6amhsZWUxMjM=", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic amhsZWU6amhsZWUxMjM=\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic amhsZWU6amhsZWUxMjM=", "classification_reason": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ef2094c19fe96005f69e7c017e21da3fab2f82f1", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 1221, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic amhsZWU6amhsZWUxMjM=", "attack_vector": "slowloris \u00b7 via HTTP:1221 \u00b7 (tentative d'exploit) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "1221 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 28\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 8 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 28, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 28, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1221, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 1221, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "slowloris \u00b7 via HTTP:1221 \u00b7 (tentative d'exploit) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic amhsZWU6amhsZWUxMjM=", "target_port_label": "1221 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1221" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_slowloris" ], "behavior_alert_count": 1, "behavior_priority": 72 }
11/07/2026 14:09:52 UTC	TCP	8082 · HTTP	http	slowloris slowloris · via HTTP:8082 · (tentative d'exploit) · → 185.242.3.121:80	Élevée	Faible · 28
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_slowloris Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « slowloris » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 28 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic MTIzNDU6MTIzNDU= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.118119046266211, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 28, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f1fd42ee7a2c605c5b61ce3eb4809152adb3b2e3", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "classification_reason": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0463" ], "matched_pattern_names": [ "Cred Basic auth spray" ], "pattern_ids": [ "pat-0463" ], "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 28, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6cdee57fa32b37b395ec3de46edbd213", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 28 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "classification_reason": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5cd5947ffa8cd491ab22081591e96e1dd959a4dc", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "attack_vector": "slowloris \u00b7 via HTTP:8082 \u00b7 (tentative d'exploit) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab slowloris \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 28\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 8 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 28, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 28, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "slowloris \u00b7 via HTTP:8082 \u00b7 (tentative d'exploit) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "http-alt-8082", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_slowloris", "net_web_probe" ] }
11/07/2026 14:09:42 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic c3RwdGJkZDoxcWF6WFNXQA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.353551240080118, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b2204bf0f946c2f0bf660efc03f212d2", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c3RwdGJkZDoxcWF6WFNXQA==\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c3RwdGJkZDoxcWF6WFNXQA==\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c3RwdGJkZDoxcWF6WFNXQA==", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c3RwdGJkZDoxcWF6WFNXQA==\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c3RwdGJkZDoxcWF6WFNXQA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b77ad0760ecef5785a8d1504f1d9a0a977974cf7", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c3RwdGJkZDoxcWF6WFNXQA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c3RwdGJkZDoxcWF6WFNXQA==", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "http-alt-8082", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 72 }
11/07/2026 14:09:30 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 35, "payload_entropy": 4.114718016821338, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2497abaf97a20697197eadf8a6e41f27", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "da282511b5468ec87f54368ce6b761feca94f790", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "http-alt-8082", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
11/07/2026 14:09:18 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic MTox Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 94, "payload_entropy": 4.9131347307361715, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b423279c417f06937cc6d422a708a6e5", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTox\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTox\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTox", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTox\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTox", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c29d67d223ee0268bf8f091b98fca250ea1f29e3", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTox", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTox", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "http-alt-8082", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
11/07/2026 14:09:07 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic dXNlcjp1c2VyMTIz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.136533219713567, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "75da72ba3e888d03e757edb3a86c4f37", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "32f72d4eddbfc74366cce31a60676080c1403730", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "http-alt-8082", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
11/07/2026 14:08:57 UTC	TCP	5122 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:5122 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 5122 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic dXNlcjpBYmNkMTIzNA== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 110, "payload_entropy": 5.251389828356501, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 5122, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c18209927506ee0a3f384f529085666c3645a883", "event_fingerprint": "7b825b3803a413ebb1d1f0dee1d5cbbdba701319", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b9794a179520e7383ebf04cdcecb3931", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 5122, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8500cc8b050faad18fd577e0db22c88efdfc27de", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 5122, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:5122 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "5122 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5122, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 5122, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:5122 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "target_port_label": "5122 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5122" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "http-alt-8082", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
11/07/2026 14:08:54 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic ZGIyZmVuYzE6IVFBWnhzdzI= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 114, "payload_entropy": 5.304847716810465, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "46c2a0779afbaa95207e9141048d34dc", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZGIyZmVuYzE6IVFBWnhzdzI=\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZGIyZmVuYzE6IVFBWnhzdzI=\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZGIyZmVuYzE6IVFBWnhzdzI=", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZGIyZmVuYzE6IVFBWnhzdzI=\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZGIyZmVuYzE6IVFBWnhzdzI=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2323ad7b6889be5567351d40d605ddb14d2df905", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZGIyZmVuYzE6IVFBWnhzdzI=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZGIyZmVuYzE6IVFBWnhzdzI=", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "http-alt-8082", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
11/07/2026 14:08:50 UTC	TCP	5122 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:5122 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 5122 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic ZXhwb3J0OmV4cG9ydA== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.276122716027221, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 5122, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c18209927506ee0a3f384f529085666c3645a883", "event_fingerprint": "7b825b3803a413ebb1d1f0dee1d5cbbdba701319", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eb92f31206ea99ba8da52f42d690d0bd", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 5122, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZXhwb3J0OmV4cG9ydA==\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZXhwb3J0OmV4cG9ydA==\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZXhwb3J0OmV4cG9ydA==", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZXhwb3J0OmV4cG9ydA==\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZXhwb3J0OmV4cG9ydA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5431fc8baf01832333afcdef40b0a192bc317b6a", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 5122, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZXhwb3J0OmV4cG9ydA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:5122 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "5122 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5122, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 5122, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:5122 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZXhwb3J0OmV4cG9ydA==", "target_port_label": "5122 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5122" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "http", "http-alt-8082", "port:20125", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
11/07/2026 14:08:46 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic cm9vdDpwcmFzYW5h Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.22837602625611, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6964f480c36220f3515260e3ea2bf854", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwcmFzYW5h\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwcmFzYW5h\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwcmFzYW5h", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwcmFzYW5h\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwcmFzYW5h", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2b76bde3f52b776da095e071d546410123dafb97", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwcmFzYW5h", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwcmFzYW5h", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 5, "multi_protocol_sample": [ "http", "http-alt-8082", "port:1221", "port:20125", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
11/07/2026 14:08:37 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic ZnRwdXNlcjozMjE= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.201444394442211, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d85648cf637601704c06b09c61fcfd60", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZnRwdXNlcjozMjE=\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZnRwdXNlcjozMjE=\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZnRwdXNlcjozMjE=", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZnRwdXNlcjozMjE=\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZnRwdXNlcjozMjE=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "46d5c50f1af73bb3ad4ce02aa9ae0245f02b7d93", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZnRwdXNlcjozMjE=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ZnRwdXNlcjozMjE=", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 5, "multi_protocol_sample": [ "http", "http-alt-8082", "port:1221", "port:20125", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 84 }
11/07/2026 14:08:30 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic dXNlcjpBYmNkMTIzNA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.256679517229906, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "f90f5afe369fad03a8fbe7b2c07547f93670843f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4bce917b808d55ac9909f9fe7373285f", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b29b88dc5ca3a972fadc4c632e40f2c7feaa8d00", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 5, "multi_protocol_sample": [ "http", "http-alt-8082", "port:1221", "port:20125", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
11/07/2026 14:07:00 UTC	TCP	20125 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:20125 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 20125 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic MTIzNDU2OjY1NDMyMQ== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 110, "payload_entropy": 5.163794628143777, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 20125, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3f04e5dfb56e190a15056c37e4b739ec97875674", "event_fingerprint": "de9a2dade76a8eb321203968d3432bf0bcf145fd", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "366e8f4ed874860edf9e3033be403200", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 20125, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU2OjY1NDMyMQ==\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU2OjY1NDMyMQ==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU2OjY1NDMyMQ==", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU2OjY1NDMyMQ==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU2OjY1NDMyMQ==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "73c51605f1f35d41c3c3e60e72d2a63705bcd62d", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 20125, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU2OjY1NDMyMQ==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:20125 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "20125 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 20125, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 20125, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:20125 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTIzNDU2OjY1NDMyMQ==", "target_port_label": "20125 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "20125" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 5, "multi_protocol_sample": [ "http", "http-alt-8082", "port:1221", "port:20125", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
11/07/2026 14:06:49 UTC	TCP	20125 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:20125 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 20125 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic dXNlcjoxNTk3NTM= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.102723701548718, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 20125, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3f04e5dfb56e190a15056c37e4b739ec97875674", "event_fingerprint": "de9a2dade76a8eb321203968d3432bf0bcf145fd", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "695df0b6cf9194759fca1928d511c297", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 20125, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjoxNTk3NTM=\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjoxNTk3NTM=\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjoxNTk3NTM=", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjoxNTk3NTM=\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjoxNTk3NTM=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad48f77e6aa875627d40c2f8615f5ba9b40bba13", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 20125, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjoxNTk3NTM=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:20125 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "20125 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 20125, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 20125, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:20125 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjoxNTk3NTM=", "target_port_label": "20125 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "20125" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 5, "multi_protocol_sample": [ "http", "http-alt-8082", "port:1221", "port:20125", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
11/07/2026 14:06:41 UTC	TCP	5122	—	Sonde port Sonde port · port 5122 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5122 Chemin / cible — Payload Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Netiface America, Inc.", "service": null, "app_proto": null, "asn": 401626, "country": "NL", "dst_port": 5122, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "cc5e90ff7cdb46632d465dfc26a2498f08b31caa", "event_fingerprint": "533949127304399d0d39d1a89ba6438beb399f28", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 5122, "risk_score": 44 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "42b1fe09f3a7832bb2d501d87b72f24a02029b4b", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 5122 }, "attack_vector": "Sonde port \u00b7 port 5122 \u00b7 (sonde \/ probe)", "target_port_label": "5122", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 5122, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 5122 }, "attack_vector": "Sonde port \u00b7 port 5122 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "5122", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "5122" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 5, "multi_protocol_sample": [ "http", "http-alt-8082", "port:1221", "port:20125", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
11/07/2026 14:06:41 UTC	TCP	5122	—	proxy probe proxy probe · port 5122 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags socks4_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5122 Chemin / cible — Payload P Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) P Meta JSON brut { "bytes_in": 9, "payload_entropy": 1.4466166676282082, "port_category": "registered", "org": "Netiface America, Inc.", "service": null, "app_proto": null, "asn": 401626, "country": "NL", "dst_port": 5122, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "dbe78363c05b0418697697c3d793c094e4c956b3", "event_fingerprint": "36a05e7ca7022d4fdb5c43f15562a66da63a3a49", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ac162eba54695d7d13c3405dc0dc7492", "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3" }, "target_context": { "dst_port": 5122, "risk_score": 35 }, "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bdef0d39d2f97e1aac3368275c9eb0bbb847a15f", "protocol_details": { "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "port": 5122 }, "evidence_snippet": "P", "attack_vector": "proxy probe \u00b7 port 5122 \u00b7 (sonde \/ probe)", "target_port_label": "5122", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 5122, "protocol_emulated": null, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "port": 5122 }, "attack_vector": "proxy probe \u00b7 port 5122 \u00b7 (sonde \/ probe)", "evidence_snippet": "P", "target_port_label": "5122", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "5122" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 5, "multi_protocol_sample": [ "http", "http-alt-8082", "port:1221", "port:20125", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "socks4_greeting" ] }
11/07/2026 14:06:41 UTC	TCP	5122 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:5122 · (sonde / probe) · → 1.1.1.1:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 1.1.1.1:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 1.1.1.1:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 5122 Chemin / cible 1.1.1.1:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 1.1.1.1:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 1.1.1.1:443 HTTP/1.0 Host: 1.1.1.1 Meta JSON brut { "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "1:443", "http_ua_hash": null, "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f", "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 47, "payload_entropy": 3.912028011761936, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 5122, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c18209927506ee0a3f384f529085666c3645a883", "event_fingerprint": "c28fbcdc4d8de2db4e93eaabdfcfb73cdef2f814", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eca058040bfea8cad9218ced7d8b12d9", "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4" }, "service_name": "http", "target_context": { "dst_port": 5122, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "method": "CONNECT", "path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "evidence": { "method": "CONNECT", "path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f3dc708aa1221aa78bdd10c81be7140ef75b2142", "protocol_details": { "http_method": "CONNECT", "http_path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "port": 5122, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "attack_vector": "Sonde HTTP \u00b7 via HTTP:5122 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443", "target_port_label": "5122 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5122, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "port": 5122, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:5122 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443", "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "target_port_label": "5122 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5122" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 5, "multi_protocol_sample": [ "http", "http-alt-8082", "port:1221", "port:20125", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
11/07/2026 14:06:38 UTC	TCP	5122	—	Sonde port Sonde port · port 5122 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5122 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Netiface America, Inc.", "service": null, "app_proto": null, "asn": 401626, "country": "NL", "dst_port": 5122, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "cc5e90ff7cdb46632d465dfc26a2498f08b31caa", "event_fingerprint": "533949127304399d0d39d1a89ba6438beb399f28", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 5122, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "de7f355624a56699a18944bc3531bb91611292bd", "protocol_details": { "port": 5122 }, "attack_vector": "Sonde port \u00b7 port 5122 \u00b7 (sonde \/ probe)", "target_port_label": "5122", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 5122, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "port": 5122 }, "attack_vector": "Sonde port \u00b7 port 5122 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "5122", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "5122" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 5, "multi_protocol_sample": [ "http", "http-alt-8082", "port:1221", "port:20125", "port:5122" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
11/07/2026 14:04:57 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 1.1.1.1:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 1.1.1.1:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 1.1.1.1:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 1.1.1.1:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 1.1.1.1:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 1.1.1.1:443 HTTP/1.0 Host: 1.1.1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "1:443", "http_ua_hash": null, "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f", "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 47, "payload_entropy": 3.912028011761936, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "75220c0e2df8664e153d4742ccb719d95e7ee75b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eca058040bfea8cad9218ced7d8b12d9", "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "method": "CONNECT", "path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "evidence": { "method": "CONNECT", "path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3a11a6f8053c9317c4940742afe04debf09e1a55", "protocol_details": { "http_method": "CONNECT", "http_path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443", "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "http", "http-alt-8082", "port:1221", "port:20125" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
11/07/2026 14:04:56 UTC	TCP	8082 · HTTP ALT 8082	http-alt-8082	proxy probe proxy probe · via HTTP ALT 8082:8082 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTP-ALT-8082 WAF — Recommandation Surveiller Tags net_proxy_probe socks4_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8082 Chemin / cible — Service HTTP ALT 8082 Payload P Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) P Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 9, "payload_entropy": 1.4466166676282082, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http-alt-8082", "app_proto": "http-alt-8082", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "a7a3c304ca5decec0cee5bf721deac29c7fc5ee0", "event_fingerprint": "e56c812f963cdd84f53c96e16b478b5272021669", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "service_name": "http-alt-8082", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ac162eba54695d7d13c3405dc0dc7492", "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3" }, "target_context": { "dst_port": 8082, "service": "http-alt-8082", "service_name": "http-alt-8082", "risk_score": 35 }, "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0d8cdc3ef4be6ea53a855c52248a3b66e4ed0b45", "protocol_details": { "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "port": 8082, "service": "http-alt-8082", "service_label_fr": "HTTP ALT 8082" }, "evidence_snippet": "P", "attack_vector": "proxy probe \u00b7 via HTTP ALT 8082:8082 \u00b7 (sonde \/ probe)", "target_port_label": "8082 \u00b7 HTTP ALT 8082", "emulator_service": "http-alt-8082", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "http-alt-8082", "service_label_fr": "HTTP ALT 8082", "dst_port": 8082, "protocol_emulated": true, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8082", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "port": 8082, "service": "http-alt-8082", "service_label_fr": "HTTP ALT 8082" }, "attack_vector": "proxy probe \u00b7 via HTTP ALT 8082:8082 \u00b7 (sonde \/ probe)", "evidence_snippet": "P", "target_port_label": "8082 \u00b7 HTTP ALT 8082", "emulator_service": "http-alt-8082", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8082", "service_banner": "honeypot-http-alt-8082", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "http", "http-alt-8082", "port:1221", "port:20125" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_proxy_probe", "socks4_greeting" ] }
11/07/2026 14:04:48 UTC	TCP	8082 · HTTP ALT 8082	http-alt-8082	Scan de ports port scan syn · via HTTP ALT 8082:8082 · (reconnaissance)	Faible	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur HTTP-ALT-8082 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8082 Chemin / cible — Service HTTP ALT 8082 Payload Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance élevée (100 %) — signaux convergents Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http-alt-8082", "app_proto": "http-alt-8082", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 42, "tag_count": 0, "anomaly_count": 0, "campaign_key": "fe1eeea9db4fe10f9c4d29199d71cd915285d71d", "event_fingerprint": "0e49cbf0cd38e11c005312d70c60a0ee389bb82f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554" ], "matched_pattern_names": [ "Minecraft varint handshake" ], "pattern_ids": [ "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 42, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http-alt-8082", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8082, "service": "http-alt-8082", "service_name": "http-alt-8082", "risk_score": 42 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0116be321503804a361367f5b7f0236d9194e5a3", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 8082, "service": "http-alt-8082", "service_label_fr": "HTTP ALT 8082" }, "attack_vector": "port scan syn \u00b7 via HTTP ALT 8082:8082 \u00b7 (reconnaissance)", "target_port_label": "8082 \u00b7 HTTP ALT 8082", "emulator_service": "http-alt-8082", "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 8082 \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 42, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http-alt-8082", "service_label_fr": "HTTP ALT 8082", "dst_port": 8082, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8082", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 8082, "service": "http-alt-8082", "service_label_fr": "HTTP ALT 8082" }, "attack_vector": "port scan syn \u00b7 via HTTP ALT 8082:8082 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "8082 \u00b7 HTTP ALT 8082", "emulator_service": "http-alt-8082", "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8082", "service_banner": "honeypot-http-alt-8082", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "http", "http-alt-8082", "port:1221", "port:20125" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor" }
11/07/2026 14:04:35 UTC	TCP	8082 · HTTP ALT 8082	http-alt-8082	Scan de ports port scan syn · via HTTP ALT 8082:8082 · (reconnaissance)	Faible	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur HTTP-ALT-8082 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8082 Chemin / cible — Service HTTP ALT 8082 Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance élevée (100 %) — signaux convergents Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http-alt-8082", "app_proto": "http-alt-8082", "asn": 401626, "country": "NL", "dst_port": 8082, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 42, "tag_count": 0, "anomaly_count": 0, "campaign_key": "fe1eeea9db4fe10f9c4d29199d71cd915285d71d", "event_fingerprint": "0e49cbf0cd38e11c005312d70c60a0ee389bb82f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 42, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http-alt-8082", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8082, "service": "http-alt-8082", "service_name": "http-alt-8082", "risk_score": 42 }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a0e08c51c232a3a2730a618af3b7fbdec29c34fe", "protocol_details": { "port": 8082, "service": "http-alt-8082", "service_label_fr": "HTTP ALT 8082" }, "attack_vector": "port scan syn \u00b7 via HTTP ALT 8082:8082 \u00b7 (reconnaissance)", "target_port_label": "8082 \u00b7 HTTP ALT 8082", "emulator_service": "http-alt-8082", "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 8082 \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 42, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http-alt-8082", "service_label_fr": "HTTP ALT 8082", "dst_port": 8082, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8082", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "port": 8082, "service": "http-alt-8082", "service_label_fr": "HTTP ALT 8082" }, "attack_vector": "port scan syn \u00b7 via HTTP ALT 8082:8082 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "8082 \u00b7 HTTP ALT 8082", "emulator_service": "http-alt-8082", "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8082", "service_banner": "honeypot-http-alt-8082", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "http", "http-alt-8082", "port:1221", "port:20125" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "behavior_alert_count": 1, "behavior_priority": 72 }
11/07/2026 14:03:54 UTC	TCP	20125	—	Sonde port Sonde port · port 20125 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 20125 Chemin / cible — Payload Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Netiface America, Inc.", "service": null, "app_proto": null, "asn": 401626, "country": "NL", "dst_port": 20125, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "b8c7fdb063bcd210fd56334fc42966d59ebc8e18", "event_fingerprint": "7071ff80beff9e627500158eb0c2a59d787ab4fc", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 20125, "risk_score": 44 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "525964022c01bcbc7ef6314929f594f8d222de3d", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 20125 }, "attack_vector": "Sonde port \u00b7 port 20125 \u00b7 (sonde \/ probe)", "target_port_label": "20125", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 20125, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 20125 }, "attack_vector": "Sonde port \u00b7 port 20125 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "20125", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "20125" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:1221", "port:20125" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
11/07/2026 14:03:54 UTC	TCP	20125	—	proxy probe proxy probe · port 20125 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags socks4_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 20125 Chemin / cible — Payload P Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) P Meta JSON brut { "bytes_in": 9, "payload_entropy": 1.4466166676282082, "port_category": "registered", "org": "Netiface America, Inc.", "service": null, "app_proto": null, "asn": 401626, "country": "NL", "dst_port": 20125, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "e3581e3cebf5235130f7c23d9e914d8d4e89bb56", "event_fingerprint": "6bd4ce0866c383031af1634fc2ed5241390071c0", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ac162eba54695d7d13c3405dc0dc7492", "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3" }, "target_context": { "dst_port": 20125, "risk_score": 35 }, "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b217b3801c899cbcc222258127197e857d516145", "protocol_details": { "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "port": 20125 }, "evidence_snippet": "P", "attack_vector": "proxy probe \u00b7 port 20125 \u00b7 (sonde \/ probe)", "target_port_label": "20125", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 20125, "protocol_emulated": null, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "port": 20125 }, "attack_vector": "proxy probe \u00b7 port 20125 \u00b7 (sonde \/ probe)", "evidence_snippet": "P", "target_port_label": "20125", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "20125" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:1221", "port:20125" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "socks4_greeting" ] }
11/07/2026 14:03:54 UTC	TCP	20125 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:20125 · (sonde / probe) · → 1.1.1.1:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 1.1.1.1:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 1.1.1.1:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 20125 Chemin / cible 1.1.1.1:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 1.1.1.1:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 1.1.1.1:443 HTTP/1.0 Host: 1.1.1.1 Meta JSON brut { "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "1:443", "http_ua_hash": null, "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f", "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 47, "payload_entropy": 3.912028011761936, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 20125, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3f04e5dfb56e190a15056c37e4b739ec97875674", "event_fingerprint": "bda498fc8905f112642b6f72c18b54326c7f5142", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eca058040bfea8cad9218ced7d8b12d9", "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4" }, "service_name": "http", "target_context": { "dst_port": 20125, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "method": "CONNECT", "path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "evidence": { "method": "CONNECT", "path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d4a7c4800dee0c9f84760b9bf17362aa6066ef13", "protocol_details": { "http_method": "CONNECT", "http_path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "port": 20125, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "attack_vector": "Sonde HTTP \u00b7 via HTTP:20125 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443", "target_port_label": "20125 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 20125, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "port": 20125, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:20125 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443", "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "target_port_label": "20125 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "20125" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:1221", "port:20125" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
11/07/2026 14:03:50 UTC	TCP	20125	—	Sonde port Sonde port · port 20125 · (sonde / probe)	Faible	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 20125 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance faible (0 %) — classification prudente Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Netiface America, Inc.", "service": null, "app_proto": null, "asn": 401626, "country": "NL", "dst_port": 20125, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 33, "tag_count": 0, "anomaly_count": 0, "campaign_key": "b8c7fdb063bcd210fd56334fc42966d59ebc8e18", "event_fingerprint": "7071ff80beff9e627500158eb0c2a59d787ab4fc", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 33, "correlation_boost": 8 }, "named_classification_skipped": false, "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 20125, "risk_score": 33 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a4590be9a2d51700d1049e66f35e3378a1f8cbff", "protocol_details": { "port": 20125 }, "attack_vector": "Sonde port \u00b7 port 20125 \u00b7 (sonde \/ probe)", "target_port_label": "20125", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 33, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 20125, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "port": 20125 }, "attack_vector": "Sonde port \u00b7 port 20125 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "20125", "emulator_service": null, "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "20125" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:1221", "port:20125" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
11/07/2026 14:03:49 UTC	TCP	1221	—	Sonde port Sonde port · port 1221 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1221 Chemin / cible — Payload Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Netiface America, Inc.", "service": null, "app_proto": null, "asn": 401626, "country": "NL", "dst_port": 1221, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c181308b04db9e90cf2d03c29b802e03f0aa6f2", "event_fingerprint": "9be4819e857e42abd4b43ffb28ccb9f55fceb641", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 1221, "risk_score": 44 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1545d8f1b34cb8973c7808b245b35b52078a7b35", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1221 }, "attack_vector": "Sonde port \u00b7 port 1221 \u00b7 (sonde \/ probe)", "target_port_label": "1221", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 1221, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1221 }, "attack_vector": "Sonde port \u00b7 port 1221 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1221", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "1221" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
11/07/2026 14:03:49 UTC	TCP	1221	—	proxy probe proxy probe · port 1221 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags socks4_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1221 Chemin / cible — Payload P Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) P Meta JSON brut { "bytes_in": 9, "payload_entropy": 1.4466166676282082, "port_category": "registered", "org": "Netiface America, Inc.", "service": null, "app_proto": null, "asn": 401626, "country": "NL", "dst_port": 1221, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "012bde7a10dbef1af6d51e61adab6a2f54f908b7", "event_fingerprint": "a9fc401a1bf44c848057fc06fa51632d0beaf721", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 35 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ac162eba54695d7d13c3405dc0dc7492", "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3" }, "target_context": { "dst_port": 1221, "risk_score": 35 }, "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fb3dd4ae288de248c43e44131be8a40b41141cd1", "protocol_details": { "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "port": 1221 }, "evidence_snippet": "P", "attack_vector": "proxy probe \u00b7 port 1221 \u00b7 (sonde \/ probe)", "target_port_label": "1221", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 1221, "protocol_emulated": null, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "port": 1221 }, "attack_vector": "proxy probe \u00b7 port 1221 \u00b7 (sonde \/ probe)", "evidence_snippet": "P", "target_port_label": "1221", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "1221" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "socks4_greeting" ] }
11/07/2026 14:03:49 UTC	TCP	1221 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:1221 · (sonde / probe) · → 1.1.1.1:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 1.1.1.1:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 1.1.1.1:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 1221 Chemin / cible 1.1.1.1:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 1.1.1.1:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 1.1.1.1:443 HTTP/1.0 Host: 1.1.1.1 Meta JSON brut { "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "1:443", "http_ua_hash": null, "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f", "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 47, "payload_entropy": 3.912028011761936, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 1221, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "39a3a18aa112fb4e4ca90956064d23c3308a55b6", "event_fingerprint": "5a390daeb58d944b012384dabef5c4912f1d6e02", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eca058040bfea8cad9218ced7d8b12d9", "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4" }, "service_name": "http", "target_context": { "dst_port": 1221, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "method": "CONNECT", "path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "evidence": { "method": "CONNECT", "path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "222e237b17c76292193bf756a85373e35e5690d2", "protocol_details": { "http_method": "CONNECT", "http_path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "port": 1221, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "attack_vector": "Sonde HTTP \u00b7 via HTTP:1221 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443", "target_port_label": "1221 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1221, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "port": 1221, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:1221 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443", "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "target_port_label": "1221 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1221" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:1221" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
11/07/2026 14:03:45 UTC	TCP	1221	—	Sonde port Sonde port · port 1221 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1221 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Netiface America, Inc.", "service": null, "app_proto": null, "asn": 401626, "country": "NL", "dst_port": 1221, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c181308b04db9e90cf2d03c29b802e03f0aa6f2", "event_fingerprint": "9be4819e857e42abd4b43ffb28ccb9f55fceb641", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 1221, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a28e36548ba3f5b1961962eb06472bfcb347354d", "protocol_details": { "port": 1221 }, "attack_vector": "Sonde port \u00b7 port 1221 \u00b7 (sonde \/ probe)", "target_port_label": "1221", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 1221, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 1221 }, "attack_vector": "Sonde port \u00b7 port 1221 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1221", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "1221" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
11/07/2026 05:22:43 UTC	TCP	20648 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:20648 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 20648 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.188069243764934, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 20648, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d15fafcc0cacbad2fa9e951201ab679abbf53c8e", "event_fingerprint": "fe734e35112d5b65006d005e4d0af2f1e490183f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9f64970177eb376939be39ff4e5d911c", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 20648, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "18968c5e2702588cfbd168d8bbe69d3d15fd560d", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 20648, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "20648" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
11/07/2026 05:22:34 UTC	TCP	20648 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:20648 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 20648 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 110, "payload_entropy": 5.26044857765059, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 20648, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d15fafcc0cacbad2fa9e951201ab679abbf53c8e", "event_fingerprint": "fe734e35112d5b65006d005e4d0af2f1e490183f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0e037d79ba3355bd5890487a08bd7a2b", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 20648, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg==\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg==", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1e2d875c98f2ce0d5304189868bf7a40c83c3573", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 20648, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg==", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "20648" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
11/07/2026 05:22:29 UTC	TCP	20648 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:20648 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 20648 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic dXNlcjE6cGFzczE= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.169513065188773, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 20648, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d15fafcc0cacbad2fa9e951201ab679abbf53c8e", "event_fingerprint": "fe734e35112d5b65006d005e4d0af2f1e490183f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c72664fc9a8d1ce810ecc34658c03487", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 20648, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3b7667604960e2cd22d170f2a8cdeb4dde9ad7e7", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 20648, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "20648" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
11/07/2026 05:22:28 UTC	TCP	20648 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:20648 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 20648 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic cm9vdDoxMjM0 Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 5.125791566046485, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 20648, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d15fafcc0cacbad2fa9e951201ab679abbf53c8e", "event_fingerprint": "fe734e35112d5b65006d005e4d0af2f1e490183f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9f118b823d7b1ea97450ad83b937b071", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 20648, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "65976d35d5bf00554549db8aebc4966e2a083daa", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 20648, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "20648" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
11/07/2026 05:22:26 UTC	TCP	20648 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:20648 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 20648 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic dXNlcjpzaGFkb3c= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.219946839206432, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 20648, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d15fafcc0cacbad2fa9e951201ab679abbf53c8e", "event_fingerprint": "fe734e35112d5b65006d005e4d0af2f1e490183f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "781dec2220a00fc0b37a6a8b6ac0be64", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 20648, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "70cab21b2fd6f12e761716007309b82a28adfb0b", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 20648, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "20648" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
05/07/2026 13:56:48 UTC	TCP	12649	—	Sonde port Sonde port · port 12649 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 12649 Chemin / cible — Payload Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Netiface America, Inc.", "service": null, "app_proto": null, "asn": 401626, "country": "NL", "dst_port": 12649, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 0.2, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "d9548d973c75ff3d666bbc8d7e1b799d39413fca", "event_fingerprint": "de916b7a4d11e33bababc1ab274e649495a73eb4", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 12649, "risk_score": 44 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2249c9d7727feae4a21d4003cefbe7a414f0b30d", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 12649 }, "attack_vector": "Sonde port \u00b7 port 12649 \u00b7 (sonde \/ probe)", "target_port_label": "12649", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 12649, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 12649 }, "attack_vector": "Sonde port \u00b7 port 12649 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "12649", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "12649" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
05/07/2026 13:56:48 UTC	TCP	12649	—	proxy probe proxy probe · port 12649 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags socks4_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 12649 Chemin / cible — Payload P Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) P Meta JSON brut { "bytes_in": 9, "payload_entropy": 1.4466166676282082, "port_category": "registered", "org": "Netiface America, Inc.", "service": null, "app_proto": null, "asn": 401626, "country": "NL", "dst_port": 12649, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 0.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "701b72462277a8b8e1214f3db67ef5fd192ff045", "event_fingerprint": "84640cb3b83386d6370375e276eb6c6c023b8f68", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 35 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ac162eba54695d7d13c3405dc0dc7492", "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3" }, "target_context": { "dst_port": 12649, "risk_score": 35 }, "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "403180d5a74438c5b91d8e5705419457802e5bf8", "protocol_details": { "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "port": 12649 }, "evidence_snippet": "P", "attack_vector": "proxy probe \u00b7 port 12649 \u00b7 (sonde \/ probe)", "target_port_label": "12649", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 12649, "protocol_emulated": null, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "port": 12649 }, "attack_vector": "proxy probe \u00b7 port 12649 \u00b7 (sonde \/ probe)", "evidence_snippet": "P", "target_port_label": "12649", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "12649" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "socks4_greeting" ] }
05/07/2026 13:56:48 UTC	TCP	12649 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:12649 · (sonde / probe) · → 1.1.1.1:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 1.1.1.1:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 1.1.1.1:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 12649 Chemin / cible 1.1.1.1:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 1.1.1.1:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 1.1.1.1:443 HTTP/1.0 Host: 1.1.1.1 Meta JSON brut { "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "1:443", "http_ua_hash": null, "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f", "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 47, "payload_entropy": 3.912028011761936, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 12649, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "ec792aa7bc886940d8854a58e912effdebe07b87", "event_fingerprint": "5c666b1f6b7d3ef4f24c84685b0dfc43296c1f11", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eca058040bfea8cad9218ced7d8b12d9", "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4" }, "service_name": "http", "target_context": { "dst_port": 12649, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "method": "CONNECT", "path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "evidence": { "method": "CONNECT", "path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6587edcfc5b29450bb185f5458cdd7e0e2482333", "protocol_details": { "http_method": "CONNECT", "http_path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "port": 12649, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "attack_vector": "Sonde HTTP \u00b7 via HTTP:12649 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443", "target_port_label": "12649 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12649, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "port": 12649, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:12649 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443", "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "target_port_label": "12649 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12649" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:12649" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
05/07/2026 13:56:45 UTC	TCP	12649	—	Sonde port Sonde port · port 12649 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 12649 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Netiface America, Inc.", "service": null, "app_proto": null, "asn": 401626, "country": "NL", "dst_port": 12649, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 0.2, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "d9548d973c75ff3d666bbc8d7e1b799d39413fca", "event_fingerprint": "de916b7a4d11e33bababc1ab274e649495a73eb4", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 12649, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "562e2a497cb892da52932c97fd02fbd789dfa3be", "protocol_details": { "port": 12649 }, "attack_vector": "Sonde port \u00b7 port 12649 \u00b7 (sonde \/ probe)", "target_port_label": "12649", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 12649, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 12649 }, "attack_vector": "Sonde port \u00b7 port 12649 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "12649", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "12649" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
05/07/2026 08:41:49 UTC	TCP	21323 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 21323 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic dXNlcjpRd2VydHkxMg== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 110, "payload_entropy": 5.255466019408381, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 21323, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e", "event_fingerprint": "df68be6bd0e58423788847a386e85cddbe832cb1", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "94e979b8fd71a11773ae965ae576edb3", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 21323, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpRd2VydHkxMg==\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpRd2VydHkxMg==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpRd2VydHkxMg==", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpRd2VydHkxMg==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpRd2VydHkxMg==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d55e2722f89204919b12599b0ac3576fc79da772", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpRd2VydHkxMg==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 21323, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjpRd2VydHkxMg==", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "21323" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
05/07/2026 08:35:53 UTC	TCP	21323 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 21323 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic bG9naW46cGFzcw== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.183518596990418, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 21323, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e", "event_fingerprint": "df68be6bd0e58423788847a386e85cddbe832cb1", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0147f89c7f9def89027d2f9b7d330972", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 21323, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bG9naW46cGFzcw==\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bG9naW46cGFzcw==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bG9naW46cGFzcw==", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bG9naW46cGFzcw==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bG9naW46cGFzcw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "012bf9e7756f59ef0ad77a8b63209fcb83ee4db8", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bG9naW46cGFzcw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 21323, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bG9naW46cGFzcw==", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "21323" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
05/07/2026 08:30:03 UTC	TCP	21323 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 185.242.3.121:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 185.242.3.121:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 185.242.3.121:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 21323 Chemin / cible 185.242.3.121:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 185.242.3.121:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic cXF3d2VlOnFxd3dlZQ== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "121:80", "http_ua_hash": null, "http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 110, "payload_entropy": 5.19646397399317, "port_category": "registered", "org": "Netiface America, Inc.", "service": "http", "app_proto": "http", "asn": 401626, "country": "NL", "dst_port": 21323, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e", "event_fingerprint": "df68be6bd0e58423788847a386e85cddbe832cb1", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 401626, "org": "Netiface America, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9a5b5d9cb4904a8bd5f7be8c78afab76", "path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5" }, "service_name": "http", "target_context": { "dst_port": 21323, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cXF3d2VlOnFxd3dlZQ==\r\n\r\n", "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cXF3d2VlOnFxd3dlZQ==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cXF3d2VlOnFxd3dlZQ==", "evidence": { "method": "CONNECT", "path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cXF3d2VlOnFxd3dlZQ==\r\n\r\n", "payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cXF3d2VlOnFxd3dlZQ==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "88a3f19beaed9479afc9ac51bf233504a9f40b2c", "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cXF3d2VlOnFxd3dlZQ==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 21323, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "185.242.3.121:80", "request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80", "evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cXF3d2VlOnFxd3dlZQ==", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "21323" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }

185.242.3.121

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence