Détails IP 195.96.139.27

Pourquoi listée

Type « dnp3_probe » (signaux protocolaires) · confiance 51%

Confiance 51 % — Score WAF 8

Comparaison ASN / FAI

ASN 211298 · 195.96.139.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 5 événements sur la période pour cette IP.

185.247.137.161 Sonde TLS 12/10/2026 16:04 UTC
195.96.139.155 Sonde TLS 12/10/2026 16:03 UTC
87.236.176.175 Sonde TLS 12/10/2026 16:03 UTC
87.236.176.171 Sonde CoAP 12/10/2026 16:02 UTC
87.236.176.158 Sonde CoAP 12/10/2026 16:02 UTC
195.96.139.8 Sonde TLS 12/10/2026 16:01 UTC
185.247.137.153 Sonde TLS 12/10/2026 16:01 UTC
87.236.176.19 Sonde TLS 12/10/2026 16:01 UTC

IPs apparentées

Même FAI Driftnet Ltd — corrélation indicative.

185.247.137.161 Sonde TLS
195.96.139.155 Sonde TLS
87.236.176.175 Sonde TLS
87.236.176.171 Sonde CoAP
87.236.176.158 Sonde CoAP

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

POP3S TCP 2 TLS TCP 2

POP3S

2

TLS

2

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

5 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
12/10/2026 13:14:45 UTC	TCP	10121 · TLS	tls	Sonde DNP3 (OT) dnp3 probe · via TLS:10121 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 838891941d5e2238 SNI www.blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI www.blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 10121 Chemin / cible — Service TLS SNI TLS www.blacklistip.com Payload ��S��D?�"-j��n�EY�>�r- � Rq� �&��[ӈ ��9�k�}3�r��hp��0�]��6�+�/�,�0̨̩� �� /5�� $�(�#�'<=�� Pourquoi cette classification : Type « dnp3_probe » (signaux protocolaires) · confiance 51% Confiance classification 51% Risque capteur Faible · 33 Confiance : Confiance 51 % — Motif catalogue confirmé Signaux pat-0794 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Sigma DNP3 link PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��S��D?�"-j��n�EY�>�r-� Rq� �&��[ӈ��9�k�}3�r��hp��0�]��6�+�/�,�0̨̩� �� /5�� $�(�#�'<=�� Requête brute (extrait) ��S��D?�"-j��n�EY�>�r- � Rq� �&��[ӈ ��9�k�}3�r��hp��0�]��6�+�/�,�0̨̩� �� /5�� $�(�#�'<=��qwww.blacklistip.com �+ Meta JSON brut { "tls_ja3_hash": "838891941d5e22381ce009aa7cca9d11", "tls_sni": "www.blacklistip.com", "tls_weak_cipher": true, "tls_weak_cipher_count": 9, "bytes_in": 249, "payload_entropy": 5.6102429230396, "port_category": "registered", "org": "Driftnet Ltd", "service": "tls", "app_proto": "tls", "asn": 211298, "country": "GB", "dst_port": 10121, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 33, "tag_count": 2, "anomaly_count": 0, "campaign_key": "4a70512ef076dee39eb1441ac818988fe09e7e1a", "event_fingerprint": "e4eceb3976817ad247b5198b86f8310f02786dcd", "classification_reason": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%", "confidence": 0.51, "classification_confidence": 0.51, "precision_score": 60, "precision_signals": [ "pat-0794" ], "kb_rule_ids": [ "pat-0794" ], "matched_patterns": [ "pat-0794", "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Sigma DNP3 link", "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0794", "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 33 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 51, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "838891941d5e22381ce009aa7cca9d11", "payload_hash": "77a86cf73b09676a4b41991a46f115a7", "path_pattern_hash": "859b07b9d78548343d57aca7faf5fc6a", "ja4": "e912aab38ca9e8c456c441f9ab094cfe", "tls_version": "0x0303", "tls_cipher_count": 27, "tls_sni": "www.blacklistip.com", "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49160-49170-10-49188-49192-49187-49191-60-61-49159-49169-5-4,0-5-10-11-13-65281-23-18-43,29-23-24-25,0", "tls_ja4_hash": "e912aab38ca9e8c456c441f9ab094cfe", "tls_ja4": "t13i0127_c64e120eaefc_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 27, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 10121, "service": "tls", "service_name": "tls", "risk_score": 33 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003S\ufffd\ufffd\u0005D?\ufffd\u001d\"\u0003-j\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffdEY\ufffd>\ufffdr-\u000b\ufffd\rRq\ufffd \ufffd&\b\ufffd\ufffd[\u04c8\u000b\ufffd\ufffd\ufffd\ufffd9\ufffdk\ufffd}3\ufffdr\ufffd\ufffdhp\ufffd\ufffd0\ufffd]\ufffd\ufffd\u00006\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003S\ufffd\ufffd\u0005D?\ufffd\u001d\"\u0003-j\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffdEY\ufffd>\ufffdr-\u000b\ufffd\rRq\ufffd \ufffd&\b\ufffd\ufffd[\u04c8\u000b\ufffd\ufffd\ufffd\ufffd9\ufffdk\ufffd}3\ufffdr\ufffd\ufffdhp\ufffd\ufffd0\ufffd]\ufffd\ufffd\u00006\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\u0001\u0000\u0000q\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blacklistip.com\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0003\u0003\u0002\u0003\u0001\u0003\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003S\ufffd\ufffd\u0005D?\ufffd\u001d\"\u0003-j\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffdEY\ufffd>\ufffdr-\u000b\ufffd\rRq\ufffd \ufffd&\b\ufffd\ufffd[\u04c8\u000b\ufffd\ufffd\ufffd\ufffd9\ufffdk\ufffd}3\ufffdr\ufffd\ufffdhp\ufffd\ufffd0\ufffd]\ufffd\ufffd\u00006\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011", "classification_reason": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "ics_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0c133a0d671af51ea1e5545ed5bacf6a2663d572", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003S\ufffd\ufffd\u0005D?\ufffd\u001d\"\u0003-j\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffdEY\ufffd>\ufffdr-\u000b\ufffd\rRq\ufffd \ufffd&\b\ufffd\ufffd[\u04c8\u000b\ufffd\ufffd\ufffd\ufffd9\ufffdk\ufffd}3\ufffdr\ufffd\ufffdhp\ufffd\ufffd0\ufffd]\ufffd\ufffd\u00006\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011", "tls_ja3": "838891941d5e22381ce009aa7cca9d11", "tls_ja4": "e912aab38ca9e8c456c441f9ab094cfe", "tls_sni": "www.blacklistip.com", "port": 10121, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdS\ufffd\ufffdD?\ufffd\"-j\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffdEY\ufffd>\ufffdr-\ufffd\rRq\ufffd \ufffd&\ufffd\ufffd[\u04c8\ufffd\ufffd\ufffd\ufffd9\ufffdk\ufffd}3\ufffdr\ufffd\ufffdhp\ufffd\ufffd0\ufffd]\ufffd\ufffd6\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\ufffd\n\ufffd$\ufffd(\ufffd#\ufffd'<=\ufffd\ufffd", "attack_vector": "dnp3 probe \u00b7 via TLS:10121 \u00b7 (sonde \/ probe)", "target_port_label": "10121 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 51 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%", "classification_reason_label_fr": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 51, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 33 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 10121, "protocol_emulated": null, "tags_summary": [ "pat-0794" ], "tags_summary_labels_fr": [ "pat-0794" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003S\ufffd\ufffd\u0005D?\ufffd\u001d\"\u0003-j\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffdEY\ufffd>\ufffdr-\u000b\ufffd\rRq\ufffd \ufffd&\b\ufffd\ufffd[\u04c8\u000b\ufffd\ufffd\ufffd\ufffd9\ufffdk\ufffd}3\ufffdr\ufffd\ufffdhp\ufffd\ufffd0\ufffd]\ufffd\ufffd\u00006\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011", "tls_ja3": "838891941d5e22381ce009aa7cca9d11", "tls_ja4": "e912aab38ca9e8c456c441f9ab094cfe", "tls_sni": "www.blacklistip.com", "port": 10121, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "dnp3 probe \u00b7 via TLS:10121 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdS\ufffd\ufffdD?\ufffd\"-j\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffdEY\ufffd>\ufffdr-\ufffd\rRq\ufffd \ufffd&\ufffd\ufffd[\u04c8\ufffd\ufffd\ufffd\ufffd9\ufffdk\ufffd}3\ufffdr\ufffd\ufffdhp\ufffd\ufffd0\ufffd]\ufffd\ufffd6\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\ufffd\n\ufffd$\ufffd(\ufffd#\ufffd'<=\ufffd\ufffd", "target_port_label": "10121 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 51 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 51 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "10121" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
12/10/2026 13:14:43 UTC	TCP	10121 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:10121 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 26086471650ff2ae SNI www.blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI www.blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 10121 Chemin / cible — Service TLS SNI TLS www.blacklistip.com Payload &"�"꛵\|YzΊ�v�;g9��ƙo��ʒi[i}� ��;�mTaue�ȡ��<Ѕp+�ӎ��ο�<<�+�/�,�0̨̩� �� /5�� $�(�#�'<=�� Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) &"�"꛵\|YzΊ�v�;g9��ƙo��ʒi[i}� ��;�mTaue�ȡ��<Ѕp+�ӎ��ο�<<�+�/�,�0̨̩� �� /5�� $�(�#�'<=�� Requête brute (extrait) &"�"꛵\|YzΊ�v�;g9��ƙo��ʒi[i}� ��;�mTaue�ȡ��<Ѕp+�ӎ��ο�<<�+�/�,�0̨̩� �� /5�� $�(�#�'<=��www.blacklistip.com �+ Meta JSON brut { "tls_ja3_hash": "26086471650ff2aef650d748b8b581b4", "tls_sni": "www.blacklistip.com", "tls_weak_cipher": true, "tls_weak_cipher_count": 9, "bytes_in": 299, "payload_entropy": 5.900257863732475, "port_category": "registered", "org": "Driftnet Ltd", "service": "tls", "app_proto": "tls", "asn": 211298, "country": "GB", "dst_port": 10121, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "4a70512ef076dee39eb1441ac818988fe09e7e1a", "event_fingerprint": "f18fd013f26a475b4f020513c90ec94001339cc8", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "26086471650ff2aef650d748b8b581b4", "payload_hash": "9eba4868e59ab683fddf07bda518d882", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "tls_sni": "www.blacklistip.com" }, "target_context": { "dst_port": 10121, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0001&\u0001\u0000\u0001\"\u0003\u0003\ufffd\"\b\ua6f5\|Yz\u038a\ufffdv\ufffd;g9\ufffd\ufffd\ufffd\u0199o\ufffd\ufffd\u0292i[i}\ufffd \ufffd\ufffd\ufffd;\ufffdmTaue\ufffd\u0221\ufffd\u0012\ufffd<\u0405p+\ufffd\u04ce\ufffd\ufffd\u0017\ufffd\u03bf\ufffd<\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001&\u0001\u0000\u0001\"\u0003\u0003\ufffd\"\b\ua6f5\|Yz\u038a\ufffdv\ufffd;g9\ufffd\ufffd\ufffd\u0199o\ufffd\ufffd\u0292i[i}\ufffd \ufffd\ufffd\ufffd;\ufffdmTaue\ufffd\u0221\ufffd\u0012\ufffd<\u0405p+\ufffd\u04ce\ufffd\ufffd\u0017\ufffd\u03bf\ufffd<\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blacklistip.com\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u000b\n\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0003", "payload_snippet": "\u0016\u0003\u0001\u0001&\u0001\u0000\u0001\"\u0003\u0003\ufffd\"\b\ua6f5\|Yz\u038a\ufffdv\ufffd;g9\ufffd\ufffd\ufffd\u0199o\ufffd\ufffd\u0292i[i}\ufffd \ufffd\ufffd\ufffd;\ufffdmTaue\ufffd\u0221\ufffd\u0012\ufffd<\u0405p+\ufffd\u04ce\ufffd\ufffd\u0017\ufffd\u03bf\ufffd<\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2fadcc1ae161559c38351a920334a86c489002fd", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001&\u0001\u0000\u0001\"\u0003\u0003\ufffd\"\b\ua6f5\|Yz\u038a\ufffdv\ufffd;g9\ufffd\ufffd\ufffd\u0199o\ufffd\ufffd\u0292i[i}\ufffd \ufffd\ufffd\ufffd;\ufffdmTaue\ufffd\u0221\ufffd\u0012\ufffd<\u0405p+\ufffd\u04ce\ufffd\ufffd\u0017\ufffd\u03bf\ufffd<\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011", "tls_ja3": "26086471650ff2aef650d748b8b581b4", "tls_sni": "www.blacklistip.com", "port": 10121, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "&\"\ufffd\"\ua6f5\|Yz\u038a\ufffdv\ufffd;g9\ufffd\ufffd\ufffd\u0199o\ufffd\ufffd\u0292i[i}\ufffd \ufffd\ufffd\ufffd;\ufffdmTaue\ufffd\u0221\ufffd\ufffd<\u0405p+\ufffd\u04ce\ufffd\ufffd\ufffd\u03bf\ufffd<<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\ufffd\n\ufffd$\ufffd(\ufffd#\ufffd'<=\ufffd\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:10121 \u00b7 (sonde \/ probe)", "target_port_label": "10121 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 10121, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001&\u0001\u0000\u0001\"\u0003\u0003\ufffd\"\b\ua6f5\|Yz\u038a\ufffdv\ufffd;g9\ufffd\ufffd\ufffd\u0199o\ufffd\ufffd\u0292i[i}\ufffd \ufffd\ufffd\ufffd;\ufffdmTaue\ufffd\u0221\ufffd\u0012\ufffd<\u0405p+\ufffd\u04ce\ufffd\ufffd\u0017\ufffd\u03bf\ufffd<\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011", "tls_ja3": "26086471650ff2aef650d748b8b581b4", "tls_sni": "www.blacklistip.com", "port": 10121, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:10121 \u00b7 (sonde \/ probe)", "evidence_snippet": "&\"\ufffd\"\ua6f5\|Yz\u038a\ufffdv\ufffd;g9\ufffd\ufffd\ufffd\u0199o\ufffd\ufffd\u0292i[i}\ufffd \ufffd\ufffd\ufffd;\ufffdmTaue\ufffd\u0221\ufffd\ufffd<\u0405p+\ufffd\u04ce\ufffd\ufffd\ufffd\u03bf\ufffd<<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\ufffd\n\ufffd$\ufffd(\ufffd#\ufffd'<=\ufffd\ufffd", "target_port_label": "10121 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "10121" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
12/10/2026 05:42:43 UTC	TCP	1200	—	Sonde port 1200 Sonde port · port 1200 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1200 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Driftnet Ltd", "service": null, "app_proto": null, "asn": 211298, "country": "GB", "dst_port": 1200, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "7b4cbf03b7a4ca4eb026d174486e1e3b356d1a4c", "event_fingerprint": "16b3652c799a5e05693a1655b5e5f04b0e57a6e3", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 10 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 1200, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a99479a99c4fd89df28b0a3f3df5b5d67e216a51", "protocol_details": { "port": 1200 }, "attack_vector": "Sonde port \u00b7 port 1200 \u00b7 (sonde \/ probe)", "target_port_label": "1200", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 1200, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "port": 1200 }, "attack_vector": "Sonde port \u00b7 port 1200 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1200", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "1200" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "195.96.139.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 01:48:18 UTC	TCP	995 · POP3S	pop3s	Sonde CoAP coap probe · via POP3S:995 · (sonde / probe)	Élevée	Moyen · 44
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur POP3S WAF — Recommandation Surveiller Tags net_pop3_probe pop3s_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 995 Chemin / cible — Service POP3S Payload x@,� ��.J� (DESCRIPTION=(CONNECT_DATA=(COMMAND=version))) Pourquoi cette classification : Type « coap_probe » (signaux protocolaires) · confiance 51% Confiance classification 61% Corrélation +10 Risque capteur Moyen · 44 Confiance : Confiance 51 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0798 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Sigma CoAP GET Oracle TNS connect Mumble ping STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) x@,� ��.J� (DESCRIPTION=(CONNECT_DATA=(COMMAND=version))) Meta JSON brut { "protocol_emulated": true, "emulator_response": "2b4f4b20504f503320686f6e6579706f742072656164790d0a", "emulator_response_len": 25, "bytes_in": 120, "payload_entropy": 3.7767332280322057, "port_category": "well_known", "org": "Driftnet Ltd", "service": "pop3s", "app_proto": "pop3s", "asn": 211298, "country": "GB", "dst_port": 995, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.2, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 44, "tag_count": 2, "anomaly_count": 0, "campaign_key": "97403f9f6bf8313ef2b67cdc1a7d7f2645da71b2", "event_fingerprint": "0353453bbb76e4d6b1b3ea18095b3c0820f92351", "classification_reason": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%", "confidence": 0.61, "classification_confidence": 0.61, "precision_score": 60, "precision_signals": [ "pat-0798" ], "kb_rule_ids": [ "pat-0798" ], "matched_patterns": [ "pat-0798", "pat-0520", "pat-0768", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "Sigma CoAP GET", "Oracle TNS connect", "Mumble ping", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0798", "pat-0520", "pat-0768", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 44, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "pop3s", "risk_confidence_factor": 51, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "23d3c06c35f8c6cbf5e96986cd00304d", "path_pattern_hash": "2bc9f93b3f58e74e96efca118403941c" }, "target_context": { "dst_port": 995, "service": "pop3s", "service_name": "pop3s", "risk_score": 44 }, "payload_preview": "\u0000x\u0000\u0000\u0001\u0000\u0000\u0000\u0001@\u0001,\u0000\ufffd \u0000\ufffd\ufffd\b\u0000\u0000\u0001\u0000\u0000.\u0000J\u0000\u0000\u0007\ufffd\u0004\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(COMMAND=version)))", "request_sample": "\u0000x\u0000\u0000\u0001\u0000\u0000\u0000\u0001@\u0001,\u0000\ufffd \u0000\ufffd\ufffd\b\u0000\u0000\u0001\u0000\u0000.\u0000J\u0000\u0000\u0007\ufffd\u0004\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(COMMAND=version)))", "payload_snippet": "\u0000x\u0000\u0000\u0001\u0000\u0000\u0000\u0001@\u0001,\u0000\ufffd \u0000\ufffd\ufffd\b\u0000\u0000\u0001\u0000\u0000.\u0000J\u0000\u0000\u0007\ufffd\u0004\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(COMMAND=version)))", "evidence": { "request_sample": "\u0000x\u0000\u0000\u0001\u0000\u0000\u0000\u0001@\u0001,\u0000\ufffd \u0000\ufffd\ufffd\b\u0000\u0000\u0001\u0000\u0000.\u0000J\u0000\u0000\u0007\ufffd\u0004\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(COMMAND=version)))", "payload_snippet": "\u0000x\u0000\u0000\u0001\u0000\u0000\u0000\u0001@\u0001,\u0000\ufffd \u0000\ufffd\ufffd\b\u0000\u0000\u0001\u0000\u0000.\u0000J\u0000\u0000\u0007\ufffd\u0004\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(COMMAND=version)))", "classification_reason": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8fb02edd278bf1979e694bc6076a9a282af9f6fc", "protocol_details": { "pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)", "payload_preview": "\u0000x\u0000\u0000\u0001\u0000\u0000\u0000\u0001@\u0001,\u0000\ufffd \u0000\ufffd\ufffd\b\u0000\u0000\u0001\u0000\u0000.\u0000J\u0000\u0000\u0007\ufffd\u0004\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(COMMAND=version)))", "port": 995, "service": "pop3s", "service_label_fr": "POP3S" }, "evidence_snippet": "x@,\ufffd \ufffd\ufffd.J\ufffd (DESCRIPTION=(CONNECT_DATA=(COMMAND=version)))", "attack_vector": "coap probe \u00b7 via POP3S:995 \u00b7 (sonde \/ probe)", "target_port_label": "995 \u00b7 POP3S", "emulator_service": "pop3s", "confidence_reason": "Confiance 51 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%", "classification_reason_label_fr": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 61, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 44, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 44, "risk_label": "Moyen", "service_name": "pop3s", "service_label_fr": "POP3S", "dst_port": 995, "protocol_emulated": true, "tags_summary": [ "pat-0798" ], "tags_summary_labels_fr": [ "pat-0798" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-pop3s", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)", "payload_preview": "\u0000x\u0000\u0000\u0001\u0000\u0000\u0000\u0001@\u0001,\u0000\ufffd \u0000\ufffd\ufffd\b\u0000\u0000\u0001\u0000\u0000.\u0000J\u0000\u0000\u0007\ufffd\u0004\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(COMMAND=version)))", "port": 995, "service": "pop3s", "service_label_fr": "POP3S" }, "attack_vector": "coap probe \u00b7 via POP3S:995 \u00b7 (sonde \/ probe)", "evidence_snippet": "x@,\ufffd \ufffd\ufffd.J\ufffd (DESCRIPTION=(CONNECT_DATA=(COMMAND=version)))", "target_port_label": "995 \u00b7 POP3S", "emulator_service": "pop3s", "confidence_reason": "Confiance 51 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 61 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "pop3s", "service_banner": "honeypot-pop3s", "service_os": "linux", "dst_port": "995" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "195.96.139.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_pop3_probe", "pop3s_emulated" ] }
12/10/2026 01:44:21 UTC	TCP	995 · POP3S	pop3s	Sonde RTSP rtsp probe · via POP3S:995 · (sonde / probe)	Élevée	Moyen · 44
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur POP3S WAF — Recommandation Surveiller Tags net_pop3_probe pop3s_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 995 Chemin / cible — Service POP3S Payload OPTIONS * RTSP/1.0 CSeq: 1 Pourquoi cette classification : Type « rtsp_probe » (signaux protocolaires) · confiance 49% Confiance classification 59% Corrélation +10 Risque capteur Moyen · 44 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0382 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RTSP protocol HTTP OPTIONS method User-Agent — Règles WAF — Payload (extrait) OPTIONS * RTSP/1.0 CSeq: 1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "2b4f4b20504f503320686f6e6579706f742072656164790d0a", "emulator_response_len": 25, "bytes_in": 31, "payload_entropy": 4.082597923010943, "port_category": "well_known", "org": "Driftnet Ltd", "service": "pop3s", "app_proto": "pop3s", "asn": 211298, "country": "GB", "dst_port": 995, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.2, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 44, "tag_count": 2, "anomaly_count": 0, "campaign_key": "97403f9f6bf8313ef2b67cdc1a7d7f2645da71b2", "event_fingerprint": "0353453bbb76e4d6b1b3ea18095b3c0820f92351", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 58, "precision_signals": [ "pat-0382" ], "kb_rule_ids": [ "pat-0382" ], "matched_patterns": [ "pat-0382", "pat-0420" ], "matched_pattern_names": [ "RTSP protocol", "HTTP OPTIONS method" ], "pattern_ids": [ "pat-0382", "pat-0420" ], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 44, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "pop3s", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "22efd140cf33afa66c67e67963ca0a78", "path_pattern_hash": "b1dd2a100b4c2489a836875293183168" }, "target_context": { "dst_port": 995, "service": "pop3s", "service_name": "pop3s", "risk_score": 44 }, "payload_preview": "OPTIONS * RTSP\/1.0\r\nCSeq: 1\r\n\r\n", "request_sample": "OPTIONS * RTSP\/1.0\r\nCSeq: 1\r\n\r\n", "payload_snippet": "OPTIONS * RTSP\/1.0\r\nCSeq: 1", "evidence": { "request_sample": "OPTIONS * RTSP\/1.0\r\nCSeq: 1\r\n\r\n", "payload_snippet": "OPTIONS * RTSP\/1.0\r\nCSeq: 1", "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f0c3161faef6716c62c10d9fa14cea3d4a468803", "protocol_details": { "pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)", "payload_preview": "OPTIONS * RTSP\/1.0\r\nCSeq: 1", "port": 995, "service": "pop3s", "service_label_fr": "POP3S" }, "evidence_snippet": "OPTIONS * RTSP\/1.0\r\nCSeq: 1", "attack_vector": "rtsp probe \u00b7 via POP3S:995 \u00b7 (sonde \/ probe)", "target_port_label": "995 \u00b7 POP3S", "emulator_service": "pop3s", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab rtsp_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 44, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 44, "risk_label": "Moyen", "service_name": "pop3s", "service_label_fr": "POP3S", "dst_port": 995, "protocol_emulated": true, "tags_summary": [ "pat-0382" ], "tags_summary_labels_fr": [ "pat-0382" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-pop3s", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)", "payload_preview": "OPTIONS * RTSP\/1.0\r\nCSeq: 1", "port": 995, "service": "pop3s", "service_label_fr": "POP3S" }, "attack_vector": "rtsp probe \u00b7 via POP3S:995 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS * RTSP\/1.0\r\nCSeq: 1", "target_port_label": "995 \u00b7 POP3S", "emulator_service": "pop3s", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "pop3s", "service_banner": "honeypot-pop3s", "service_os": "linux", "dst_port": "995" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "195.96.139.0\/24", "coordinated_ip_count": 8, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_pop3_probe", "pop3s_emulated" ] }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

195.96.139.27

Synthèse

Pourquoi listée

Comparaison ASN / FAI

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence