Détails IP 195.96.139.52

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « mqtt_probe » (signaux protocolaires) · confiance 97%

Confiance 100 % — Score WAF 8 · Bonus corrélation +10

Comparaison ASN / FAI

ASN 211298 · 195.96.139.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 9 événements sur la période pour cette IP.

195.96.139.126 Sonde MySQL 28/07/2026 08:39 UTC
185.247.137.126 Sonde MySQL 28/07/2026 08:39 UTC
87.236.176.125 Sonde MySQL 28/07/2026 08:39 UTC
87.236.176.141 Sonde MySQL 28/07/2026 08:39 UTC
87.236.176.127 Sonde MySQL 28/07/2026 08:38 UTC
185.247.137.132 Sonde MySQL 28/07/2026 08:38 UTC
195.96.139.144 Sonde Memcached 28/07/2026 08:38 UTC
87.236.176.122 Sonde MySQL 28/07/2026 08:38 UTC

IPs apparentées

Même FAI Driftnet Ltd — corrélation indicative.

195.96.139.126 Sonde MySQL
185.247.137.126 Sonde MySQL
87.236.176.125 Sonde MySQL
87.236.176.141 Sonde MySQL
87.236.176.127 Sonde MySQL

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

SSH TCP 5 TLS TCP 2 HTTPS TCP 1 RDP TCP 1

SSH

5

TLS

2

HTTPS

1

RDP

1

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

9 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
27/07/2026 14:58:56 UTC	TCP	22 · SSH	ssh	mqtt probe mqtt probe · via SSH:22 · (sonde / probe)	Élevée	Moyen · 49
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE T1046 TA0007 TA0001 Protocole Émulateur SSH WAF — Recommandation Surveiller Tags mqtt_connect net_ssh_probe ssh_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Payload MQTT< Pourquoi cette classification : Type « mqtt_probe » (signaux protocolaires) · confiance 97% Confiance classification 100% Corrélation +10 Risque capteur Moyen · 49 Confiance : Confiance 97 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0373 pat-0615 Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MQTT protocol MQTT alt CONNECT Mumble ping Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) MQTT< Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 20, "payload_entropy": 2.9219280948873623, "port_category": "well_known", "org": "Driftnet Ltd", "service": "ssh", "app_proto": "ssh", "asn": 211298, "country": "GB", "dst_port": 22, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 49, "tag_count": 3, "anomaly_count": 0, "campaign_key": "70956b15dec25dba0e3944002408dfc19f77d790", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 97%", "confidence": 1, "classification_confidence": 1, "precision_score": 110, "precision_signals": [ "pat-0373", "pat-0615" ], "kb_rule_ids": [ "pat-0373", "pat-0615" ], "matched_patterns": [ "pat-0373", "pat-0615", "pat-0768", "pat-0554" ], "matched_pattern_names": [ "MQTT protocol", "MQTT alt CONNECT", "Mumble ping", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0373", "pat-0615", "pat-0768", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 49, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 97, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "67a0c4c14be2259960886e7ac48d201e", "path_pattern_hash": "4449b927317468afa12a2f935a413459" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 49 }, "payload_preview": "\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0005\u0011\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0005\u0011\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0005\u0011\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0005\u0011\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0005\u0011\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 97%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1a91dce9ecfd71909007b29f35b14159a3c8ce5c", "protocol_details": { "payload_preview": "\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0005\u0011\u0000\u0000\u0000\u0000\u0000\u0000", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "MQTT<", "attack_vector": "mqtt probe \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 97%", "classification_reason_label_fr": "Type \u00ab mqtt_probe \u00bb (signaux protocolaires) \u00b7 confiance 97%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 49\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 49, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "pat-0373", "pat-0615" ], "tags_summary_labels_fr": [ "pat-0373", "pat-0615" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0005\u0011\u0000\u0000\u0000\u0000\u0000\u0000", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "mqtt probe \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "MQTT<", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 97 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "195.96.139.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "mqtt_connect", "net_ssh_probe", "ssh_emulated" ] }
17/07/2026 17:19:21 UTC	TCP	22 · SSH	ssh	SSRF interne ssrf internal · via SSH:22 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0001 TA0001 TA0002 Protocole Émulateur SSH WAF — Recommandation Surveiller Tags net_ssh_probe ssh_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Payload HELFD��$opc.tcp://localhost:4840/UADiscovery Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54% Confiance classification 64% Corrélation +10 Risque capteur Moyen · 46 Confiance : Confiance 54 % — Motif catalogue confirmé Protocole émulé 1 Signaux CRS-920350 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass OPC UA HEL Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) HELFD��$opc.tcp://localhost:4840/UADiscovery Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a", "emulator_response_len": 39, "bytes_in": 68, "payload_entropy": 4.215061186361338, "port_category": "well_known", "org": "Driftnet Ltd", "service": "ssh", "app_proto": "ssh", "asn": 211298, "country": "GB", "dst_port": 22, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 46, "tag_count": 2, "anomaly_count": 0, "campaign_key": "ec742e1f26595cf120b330e5f862965c23dfeeb2", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "confidence": 0.64, "classification_confidence": 0.64, "precision_score": 64, "precision_signals": [ "CRS-920350" ], "kb_rule_ids": [ "CRS-920350" ], "matched_patterns": [ "pat-0103", "pat-0626", "pat-0554" ], "matched_pattern_names": [ "LFI Double-dot bypass", "OPC UA HEL", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0103", "pat-0626", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 46, "correlation_boost": 10 }, "named_classification_skipped": false, "classification_parent": "ssrf_attack", "service_name": "ssh", "risk_confidence_factor": 54, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "25ff696378674b05597657718486af19", "path_pattern_hash": "2926fa5ba65a298fe7630f4e1d1dd6ea" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 46 }, "payload_preview": "HELFD\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0000\u0000opc.tcp:\/\/localhost:4840\/UADiscovery", "request_sample": "HELFD\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0000\u0000opc.tcp:\/\/localhost:4840\/UADiscovery", "payload_snippet": "HELFD\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0000\u0000opc.tcp:\/\/localhost:4840\/UADiscovery", "evidence": { "request_sample": "HELFD\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0000\u0000opc.tcp:\/\/localhost:4840\/UADiscovery", "payload_snippet": "HELFD\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0000\u0000opc.tcp:\/\/localhost:4840\/UADiscovery", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4c2f679d9851f342c48fc066fc93d533de89d949", "protocol_details": { "payload_preview": "HELFD\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0000\u0000opc.tcp:\/\/localhost:4840\/UADiscovery", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "HELFD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$opc.tcp:\/\/localhost:4840\/UADiscovery", "attack_vector": "ssrf internal \u00b7 via SSH:22 \u00b7 (tentative d'exploit)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via SSH \u2014 campagne \/24 (195.96.139.0\/24)", "confidence_pct": 64, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 46, "correlation_boost": 10 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 46, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "CRS-920350" ], "tags_summary_labels_fr": [ "CRS-920350" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "HELFD\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0000\u0000opc.tcp:\/\/localhost:4840\/UADiscovery", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "ssrf internal \u00b7 via SSH:22 \u00b7 (tentative d'exploit)", "evidence_snippet": "HELFD\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$opc.tcp:\/\/localhost:4840\/UADiscovery", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "195.96.139.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_ssh_probe", "ssh_emulated" ] }
14/07/2026 00:34:49 UTC	TCP	3389 · RDP	rdp	Flood / DDoS http flood · via RDP:3389 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur RDP WAF — Recommandation Surveiller Tags net_rdp_probe rdp_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Service RDP Payload CONNECT accept-version:1.0,1.1,2.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT accept-version:1.0,1.1,2.0 Meta JSON brut { "protocol_emulated": true, "bytes_in": 37, "payload_entropy": 4.499597622210292, "port_category": "registered", "org": "Driftnet Ltd", "service": "rdp", "app_proto": "rdp", "asn": 211298, "country": "GB", "dst_port": 3389, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 46, "tag_count": 2, "anomaly_count": 0, "campaign_key": "aa4bea48009056c8c3884e795b29aa79232ecca7", "event_fingerprint": "707be242ce71f14fac23ca7fdd82d854dc2752d8", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "rdp", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e88a4fd6d1e5b3ea318d20a60c15f5bf", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 3389, "service": "rdp", "service_name": "rdp", "risk_score": 46 }, "payload_preview": "CONNECT\naccept-version:1.0,1.1,2.0\n\n\u0000", "request_sample": "CONNECT\naccept-version:1.0,1.1,2.0\n\n\u0000", "payload_snippet": "CONNECT\naccept-version:1.0,1.1,2.0\n\n\u0000", "evidence": { "request_sample": "CONNECT\naccept-version:1.0,1.1,2.0\n\n\u0000", "payload_snippet": "CONNECT\naccept-version:1.0,1.1,2.0\n\n\u0000", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "53fdc5ea604012fa93c979ab2baca81a0b8b27b9", "protocol_details": { "payload_preview": "CONNECT\naccept-version:1.0,1.1,2.0\n\n\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "evidence_snippet": "CONNECT\naccept-version:1.0,1.1,2.0", "attack_vector": "http flood \u00b7 via RDP:3389 \u00b7 (tentative d'exploit)", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via RDP", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "rdp", "service_label_fr": "RDP", "dst_port": 3389, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "Windows RDP", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT\naccept-version:1.0,1.1,2.0\n\n\u0000", "port": 3389, "service": "rdp", "service_label_fr": "RDP" }, "attack_vector": "http flood \u00b7 via RDP:3389 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT\naccept-version:1.0,1.1,2.0", "target_port_label": "3389 \u00b7 RDP", "emulator_service": "rdp", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rdp", "service_banner": "Windows RDP", "service_os": "windows", "dst_port": "3389" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "net_rdp_probe", "rdp_emulated" ] }
13/07/2026 13:50:46 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur SSH WAF — Recommandation Surveiller Tags net_ssh_probe ssh_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Payload ��versionV�Zˀ9�Tj�� Pourquoi cette classification : Type « ssh_probe » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��versionV�Zˀ9�Tj�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a", "emulator_response_len": 39, "bytes_in": 110, "payload_entropy": 2.3639389018032553, "port_category": "well_known", "org": "Driftnet Ltd", "service": "ssh", "app_proto": "ssh", "asn": 211298, "country": "GB", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "ec742e1f26595cf120b330e5f862965c23dfeeb2", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 45, "correlation_boost": 10 }, "service_name": "ssh", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "beefb4e15d1ef14a2c3f6a9e2cd16ab7", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 45 }, "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000V\u0000\u0000\u0000\u0005\ufffdZ\u02c0\u0011\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00009\ufffdTj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000V\u0000\u0000\u0000\u0005\ufffdZ\u02c0\u0011\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00009\ufffdTj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000V\u0000\u0000\u0000\u0005\ufffdZ\u02c0\u0011\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00009\ufffdTj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000V\u0000\u0000\u0000\u0005\ufffdZ\u02c0\u0011\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00009\ufffdTj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000V\u0000\u0000\u0000\u0005\ufffdZ\u02c0\u0011\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00009\ufffdTj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0bf56287411d9479813e83e661e03d84f85ea470", "protocol_details": { "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000V\u0000\u0000\u0000\u0005\ufffdZ\u02c0\u0011\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00009\ufffdTj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionV\ufffdZ\u02c09\ufffdTj\ufffd\ufffd \ufffd\ufffd\ufffd \ufffd", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 45, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 45, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000V\u0000\u0000\u0000\u0005\ufffdZ\u02c0\u0011\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00009\ufffdTj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionV\ufffdZ\u02c09\ufffdTj\ufffd\ufffd \ufffd\ufffd\ufffd \ufffd", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "195.96.139.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_ssh_probe", "ssh_emulated" ] }
13/07/2026 13:50:43 UTC	TCP	22 · SSH	ssh	Sonde port 22/TCP port 22 tcp · via SSH:22 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur SSH WAF — Recommandation Surveiller Tags net_ssh_probe ssh_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Preuve honeypot — Sonde port 22/TCP Connexion détectée sur le port 22 (TCP) du capteur simulé. Service SSH Payload �g� �P0f�Ⱦ��M((E��[d��e��\��#�,��t1��) �#� ��js��k�J�r�Ij�B��n��l��!v��a� W��+{��s��zU"뻽(�j�� Pourquoi cette classification :* Type « port_22_tcp » (signaux protocolaires) · confiance 55% Confiance classification 65% Corrélation +10 Risque capteur Moyen · 42 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �g� �P0f�Ⱦ��M((E��[d��e��\��#�,��t1��) �#� ��js��k�J�r�Ij�B��n��l��!v��a�W��+{��s��zU"뻽(�j�� Requête brute (extrait) �g� �P0f�Ⱦ��M((E��[d��e��\��#�,��t1��) �#� ��js��k�J�r�Ij�B��n��l��!v��a� W��+{��s��zU"뻽(�j�ᦳ��'d�6�k�^��)�$3�6z �Я��4ɡ��ʄ��G]lk ��h�I��Tq�7���� ƀ\|�M�Ϗ��<��sۉ%p��8�;��ia[�U(��P�]k Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a", "emulator_response_len": 41, "bytes_in": 320, "payload_entropy": 7.312096993589062, "port_category": "well_known", "org": "Driftnet Ltd", "service": "ssh", "app_proto": "ssh", "asn": 211298, "country": "GB", "dst_port": 22, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "ec742e1f26595cf120b330e5f862965c23dfeeb2", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Type \u00ab port_22_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence": 0.65, "classification_confidence": 0.65, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 15, "risk_score": 42, "correlation_boost": 10 }, "named_classification_skipped": true, "named_candidate": "ssh_probe", "service_name": "ssh", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1cca2bbe9fa5b8ba0b3af23e81c5a708", "path_pattern_hash": "4d94c79baddfcb6b1b3c2c5fdc6c79e1" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 42 }, "payload_preview": "\ufffdg\u001c\ufffd\t\ufffdP0f\ufffd\u023e\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM((E\ufffd\ufffd\ufffd\u0012[d\ufffd\ufffde\ufffd\ufffd\\\ufffd\ufffd#\ufffd,\ufffd\ufffdt1\ufffd\ufffd)\t\ufffd#\ufffd \ufffd\ufffd\ufffdj\u0011\u0010s\ufffd\ufffd\ufffd\ufffdk\ufffdJ\ufffdr\u0010\ufffd\u001bIj\ufffdB\ufffd\u0006\ufffd\u0014n\ufffd\ufffdl\ufffd\ufffd!v\ufffd\ufffd\ufffda\ufffd\f\u0016W\ufffd\ufffd+{\ufffd\ufffds\ufffd\ufffd\ufffd\u001czU\"\u0010\ubefd(\ufffd\u0002j\ufffd\ufffd", "request_sample": "\ufffdg\u001c\ufffd\t\ufffdP0f\ufffd\u023e\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM((E\ufffd\ufffd\ufffd\u0012[d\ufffd\ufffde\ufffd\ufffd\\\ufffd\ufffd#\ufffd,\ufffd\ufffdt1\ufffd\ufffd)\t\ufffd#\ufffd \ufffd\ufffd\ufffdj\u0011\u0010s\ufffd\ufffd\ufffd\ufffdk\ufffdJ\ufffdr\u0010\ufffd\u001bIj\ufffdB\ufffd\u0006\ufffd\u0014n\ufffd\ufffdl\ufffd\ufffd!v\ufffd\ufffd\ufffda\ufffd\f\u0016W\ufffd\ufffd+{\ufffd\ufffds\ufffd\ufffd\ufffd\u001czU\"\u0010\ubefd(\ufffd\u0002j\ufffd\u19b3\ufffd\ufffd'd\u001d\ufffd6\ufffdk\ufffd\u0014^\ufffd\ufffd)\ufffd$3\ufffd6\u0014z\n\u0000\ufffd\u042f\ufffd\u0001\ufffd4\u0261\ufffd\u0011\u0002\ufffd\u0016\ufffd\u0284\ufffd\ufffdG]lk\n\ufffd\ufffd\ufffdh\ufffdI\ufffd\u0017\ufffd\ufffd\ufffd\ufffd\u0004Tq\ufffd\u001c7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001a\n\ufffd\u0180\|\ufffdM\ufffd\u03cf\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffds\u06c9\u001b\u0014%p\ufffd\u0010\ufffd\ufffd8\u0012\ufffd;\ufffd\u0001\ufffdia[\ufffd\u0004U(\ufffd\ufffdP\ufffd\u0007]k", "payload_snippet": "\ufffdg\u001c\ufffd\t\ufffdP0f\ufffd\u023e\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM((E\ufffd\ufffd\ufffd\u0012[d\ufffd\ufffde\ufffd\ufffd\\\ufffd\ufffd#\ufffd,\ufffd\ufffdt1\ufffd\ufffd)\t\ufffd#\ufffd \ufffd\ufffd\ufffdj\u0011\u0010s\ufffd\ufffd\ufffd\ufffdk\ufffdJ\ufffdr\u0010\ufffd\u001bIj\ufffdB\ufffd\u0006\ufffd\u0014n\ufffd\ufffdl\ufffd\ufffd!v\ufffd\ufffd\ufffda\ufffd\f\u0016W\ufffd\ufffd+{\ufffd\ufffds\ufffd\ufffd\ufffd\u001czU\"\u0010\ubefd(\ufffd\u0002j\ufffd\ufffd", "evidence": { "request_sample": "\ufffdg\u001c\ufffd\t\ufffdP0f\ufffd\u023e\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM((E\ufffd\ufffd\ufffd\u0012[d\ufffd\ufffde\ufffd\ufffd\\\ufffd\ufffd#\ufffd,\ufffd\ufffdt1\ufffd\ufffd)\t\ufffd#\ufffd \ufffd\ufffd\ufffdj\u0011\u0010s\ufffd\ufffd\ufffd\ufffdk\ufffdJ\ufffdr\u0010\ufffd\u001bIj\ufffdB\ufffd\u0006\ufffd\u0014n\ufffd\ufffdl\ufffd\ufffd!v\ufffd\ufffd\ufffda\ufffd\f\u0016W\ufffd\ufffd+{\ufffd\ufffds\ufffd\ufffd\ufffd\u001czU\"\u0010\ubefd(\ufffd\u0002j\ufffd\u19b3\ufffd\ufffd'd\u001d\ufffd6\ufffdk\ufffd\u0014^\ufffd\ufffd)\ufffd$3\ufffd6\u0014z\n\u0000\ufffd\u042f\ufffd\u0001\ufffd4\u0261\ufffd\u0011\u0002\ufffd\u0016\ufffd\u0284\ufffd\ufffdG]lk\n\ufffd\ufffd\ufffdh\ufffdI\ufffd\u0017\ufffd\ufffd\ufffd\ufffd\u0004Tq\ufffd\u001c7\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001a\n\ufffd\u0180\|\ufffdM\ufffd\u03cf\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffds\u06c9\u001b\u0014%p\ufffd\u0010\ufffd\ufffd8\u0012\ufffd;\ufffd\u0001\ufffdia[\ufffd\u0004U(\ufffd\ufffdP\ufffd\u0007]k", "payload_snippet": "\ufffdg\u001c\ufffd\t\ufffdP0f\ufffd\u023e\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM((E\ufffd\ufffd\ufffd\u0012[d\ufffd\ufffde\ufffd\ufffd\\\ufffd\ufffd#\ufffd,\ufffd\ufffdt1\ufffd\ufffd)\t\ufffd#\ufffd \ufffd\ufffd\ufffdj\u0011\u0010s\ufffd\ufffd\ufffd\ufffdk\ufffdJ\ufffdr\u0010\ufffd\u001bIj\ufffdB\ufffd\u0006\ufffd\u0014n\ufffd\ufffdl\ufffd\ufffd!v\ufffd\ufffd\ufffda\ufffd\f\u0016W\ufffd\ufffd+{\ufffd\ufffds\ufffd\ufffd\ufffd\u001czU\"\u0010\ubefd(\ufffd\u0002j\ufffd\ufffd", "classification_reason": "Type \u00ab port_22_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "85c0257c80437e9f9b6de4d88797e3ee9a519860", "protocol_details": { "payload_preview": "\ufffdg\u001c\ufffd\t\ufffdP0f\ufffd\u023e\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM((E\ufffd\ufffd\ufffd\u0012[d\ufffd\ufffde\ufffd\ufffd\\\ufffd\ufffd#\ufffd,\ufffd\ufffdt1\ufffd\ufffd)\t\ufffd#\ufffd \ufffd\ufffd\ufffdj\u0011\u0010s\ufffd\ufffd\ufffd\ufffdk\ufffdJ\ufffdr\u0010\ufffd\u001bIj\ufffdB\ufffd\u0006\ufffd\u0014n\ufffd\ufffdl\ufffd\ufffd!v\ufffd\ufffd\ufffda\ufffd\f\u0016W\ufffd\ufffd+{\ufffd\ufffds\ufffd\ufffd\ufffd\u001czU\"\u0010\ubefd(\ufffd\u0002j\ufffd\ufffd", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "\ufffdg\ufffd\t\ufffdP0f\ufffd\u023e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM((E\ufffd\ufffd\ufffd[d\ufffd\ufffde\ufffd\ufffd\\\ufffd\ufffd#\ufffd,\ufffd\ufffdt1\ufffd\ufffd)\t\ufffd#\ufffd \ufffd\ufffd\ufffdjs\ufffd\ufffd\ufffd\ufffdk\ufffdJ\ufffdr\ufffdIj\ufffdB\ufffd\ufffdn\ufffd\ufffdl\ufffd\ufffd!v\ufffd\ufffd\ufffda\ufffdW\ufffd\ufffd+{\ufffd\ufffds\ufffd\ufffd\ufffdzU\"\ubefd(\ufffdj\ufffd\ufffd", "attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_22_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab port_22_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100", "confidence_pct": 65, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 15, "risk_score": 42, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\ufffdg\u001c\ufffd\t\ufffdP0f\ufffd\u023e\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM((E\ufffd\ufffd\ufffd\u0012[d\ufffd\ufffde\ufffd\ufffd\\\ufffd\ufffd#\ufffd,\ufffd\ufffdt1\ufffd\ufffd)\t\ufffd#\ufffd \ufffd\ufffd\ufffdj\u0011\u0010s\ufffd\ufffd\ufffd\ufffdk\ufffdJ\ufffdr\u0010\ufffd\u001bIj\ufffdB\ufffd\u0006\ufffd\u0014n\ufffd\ufffdl\ufffd\ufffd!v\ufffd\ufffd\ufffda\ufffd\f\u0016W\ufffd\ufffd+{\ufffd\ufffds\ufffd\ufffd\ufffd\u001czU\"\u0010\ubefd(\ufffd\u0002j\ufffd\ufffd", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "port 22 tcp \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdg\ufffd\t\ufffdP0f\ufffd\u023e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdM((E\ufffd\ufffd\ufffd[d\ufffd\ufffde\ufffd\ufffd\\\ufffd\ufffd#\ufffd,\ufffd\ufffdt1*\ufffd\ufffd)\t\ufffd#\ufffd \ufffd\ufffd\ufffdjs\ufffd\ufffd\ufffd\ufffdk\ufffdJ\ufffdr\ufffdIj\ufffdB\ufffd\ufffdn\ufffd\ufffdl\ufffd\ufffd!v\ufffd\ufffd\ufffda\ufffdW\ufffd\ufffd+{\ufffd\ufffds\ufffd\ufffd\ufffdzU\"\ubefd(\ufffdj\ufffd\ufffd", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "195.96.139.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_ssh_probe", "ssh_emulated" ] }
13/07/2026 13:47:54 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SSH WAF — Recommandation Surveiller Tags net_ssh_probe ssh_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Payload ��+ Pourquoi cette classification : Type « ssh_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��+ Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 11, "payload_entropy": 2.5503407095463886, "port_category": "well_known", "org": "Driftnet Ltd", "service": "ssh", "app_proto": "ssh", "asn": 211298, "country": "GB", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "ec742e1f26595cf120b330e5f862965c23dfeeb2", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 45 }, "service_name": "ssh", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c9767933e8bea2f91aff65c6c52f7571", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 45 }, "payload_preview": "\ufffd\ufffd\u0000\u0000\u0000\u0005\u0001+\u000e\u0001\u0000", "request_sample": "\ufffd\ufffd\u0000\u0000\u0000\u0005\u0001+\u000e\u0001\u0000", "payload_snippet": "\ufffd\ufffd\u0000\u0000\u0000\u0005\u0001+\u000e\u0001\u0000", "evidence": { "request_sample": "\ufffd\ufffd\u0000\u0000\u0000\u0005\u0001+\u000e\u0001\u0000", "payload_snippet": "\ufffd\ufffd\u0000\u0000\u0000\u0005\u0001+\u000e\u0001\u0000", "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1f7f0b086253bc71154fae450d02194dce6d52bf", "protocol_details": { "payload_preview": "\ufffd\ufffd\u0000\u0000\u0000\u0005\u0001+\u000e\u0001\u0000", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "\ufffd\ufffd+", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\ufffd\ufffd\u0000\u0000\u0000\u0005\u0001+\u000e\u0001\u0000", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd+", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_ssh_probe", "ssh_emulated" ] }
04/06/2026 12:27:54 UTC	TCP	8443	tls	Sonde TLS	Élevée	Faible · 20
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8443 Chemin / cible — Confiance classification 74% Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��-E�:�P�dT��q�m�N"�L��.� h��/��/��?�tR�yP��7�fQV0y6�+�/�,�0̨̩� �� /5�� $�(�#�'<=�� Meta JSON brut { "tls_ja3_hash": "75bb8d4cb2904c08091df835e0047b98", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 9, "bytes_in": 221, "payload_entropy": 5.49218627514017, "port_category": "registered", "org": "Driftnet Ltd", "service": "tls", "app_proto": "tls", "asn": 211298, "country": "GB", "dst_port": 8443, "risk_waf": 8, "risk_classification": 30, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.8, "risk_breakdown": { "waf": 8, "classification": 30, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 20, "tag_count": 3, "anomaly_count": 0, "campaign_key": "765c1719b28b6758c599bb2367ef9ca242181d2c", "event_fingerprint": "4c272f3e68161fbe8e1c7f316809d3c843ec0c5d", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "75bb8d4cb2904c08091df835e0047b98", "payload_hash": "681d631eb58ee5a1bbe9df865d656891", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 8443, "service": "tls" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-E\ufffd:\ufffdP\ufffddT\ufffd\u000f\ufffd\ufffd\ufffd\ufffdq\u0014\ufffdm\u000b\ufffdN\"\ufffdL\ufffd\ufffd.\u0018\ufffd \u000bh\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffd\/\ufffd\ufffd?\ufffdtR\ufffd\u0015yP\ufffd\ufffd7\ufffdfQV0y\u00006\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011", "event_signature": "07daf2e286a9c6ecf8d77ac6f86bfa2d142347dc", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
04/06/2026 12:27:53 UTC	TCP	8443	tls	Sonde TLS	Élevée	Faible · 20
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8443 Chemin / cible — Confiance classification 74% Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �Ϥ��Y��A�\|3~g�T�]Dͅ �T ��[��\|��sf�W��Zj- �iz0�<�+�/�,�0̨̩� �� /5�� $�(�#�'<=�� Meta JSON brut { "tls_ja3_hash": "7024ed8c0d80542d17159473f564b551", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 9, "bytes_in": 271, "payload_entropy": 5.66819505368165, "port_category": "registered", "org": "Driftnet Ltd", "service": "tls", "app_proto": "tls", "asn": 211298, "country": "GB", "dst_port": 8443, "risk_waf": 8, "risk_classification": 30, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.8, "risk_breakdown": { "waf": 8, "classification": 30, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 20, "tag_count": 3, "anomaly_count": 0, "campaign_key": "765c1719b28b6758c599bb2367ef9ca242181d2c", "event_fingerprint": "a5c6cb0fef799616fc29fe615b211872e67d0200", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "7024ed8c0d80542d17159473f564b551", "payload_hash": "c3311e800d4a61859c8248bcdba53661", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 8443, "service": "tls" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "payload_preview": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003\ufffd\u03e4\u0006\ufffd\ufffd\ufffd\b\ufffd\ufffdY\ufffd\u0017\ufffd\ufffd\ufffdA\ufffd\|3~g\ufffdT\ufffd]D\u0007\u0345 \ufffdT\b\n\ufffd\ufffd[\u0001\ufffd\ufffd\ufffd\|\ufffd\ufffdsf\ufffdW\ufffd\ufffd\ufffd\ufffdZj-\t\ufffdi\u0018z0\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011", "event_signature": "c60f73a8ef5ccd6179f13af1525ea94b86d302c5", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
31/05/2026 06:22:34 UTC	TCP	8443	https	https probe	Élevée	Moyen · 53
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

195.96.139.52

Profil de menace

Pourquoi listée

Comparaison ASN / FAI

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence