Détails IP 195.96.139.80

Pourquoi listée

Type « postgres_probe » (signaux protocolaires) · confiance 49%

Confiance 59 % — Score WAF 8 · Bonus corrélation +10

Comparaison ASN / FAI

ASN 211298 · 195.96.139.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 7 événements sur la période pour cette IP.

195.96.139.125 Sonde PostgreSQL 13/10/2026 19:16 UTC
185.247.137.112 Sonde port 13/10/2026 19:16 UTC
195.96.139.20 Sonde PostgreSQL 13/10/2026 19:13 UTC
185.247.137.33 Sonde port 13/10/2026 19:13 UTC
185.247.137.18 SSRF 13/10/2026 18:35 UTC
195.96.139.87 Sonde PostgreSQL 13/10/2026 17:51 UTC
185.247.137.104 Sonde port 13/10/2026 17:51 UTC
195.96.139.13 Sonde PostgreSQL 13/10/2026 15:56 UTC

IPs apparentées

Même FAI Driftnet Ltd — corrélation indicative.

195.96.139.125 Sonde PostgreSQL
185.247.137.112 Sonde port
195.96.139.20 Sonde PostgreSQL
185.247.137.33 Sonde port
185.247.137.18 SSRF

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

ORACLE TCP 2 MSMQ TCP 2 TLS TCP 1 ELASTICSEARCH TRANSPORT TCP 1

ORACLE

2

MSMQ

2

TLS

1

ELASTICSEARCH TRANSPORT

1

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

7 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
13/10/2026 00:22:33 UTC	TCP	1521 · ORACLE	oracle	Sonde PostgreSQL postgres probe · via ORACLE:1521 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur ORACLE WAF — Recommandation Surveiller Tags net_oracle_tns_probe oracle_emulated oracle_payload tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1521 Chemin / cible — Service ORACLE Payload �]Y�BS�-��ܾq��(��5�KM ��c�-��IaA8`Q�k$��1R� N<�+�/�,�0̨̩� �� /5�� $�(�#�'<=�� Pourquoi cette classification :* Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 59% Corrélation +10 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header PostgreSQL startup ET H.323 setup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �]Y�BS�-��ܾq��(��5�KM ��c�-��IaA8`Q�k$��1R�N<�+�/�,�0̨̩� �� /5�� $�(�#�'<=�� Requête brute (extrait) �]Y�BS�-��ܾq��(��5�KM ��c�-��IaA8`Q�k$��1R� N<�+�/�,�0̨̩� �� /5�� $�(�#�'<=�� + 3&$ L�hN� ��u4EW�͝ Meta JSON brut { "protocol_emulated": true, "emulator_response": "0025004a0000060000000000284143434550542844454144424545462900000000000000000000", "emulator_response_len": 39, "bytes_in": 271, "payload_entropy": 5.751808394364075, "port_category": "registered", "org": "Driftnet Ltd", "service": "oracle", "app_proto": "oracle", "asn": 211298, "country": "GB", "dst_port": 1521, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c894295c6c59edc4585fffbff964fb9db8eb5248", "event_fingerprint": "5e232d65a022f2a64f918c38abebffe661d59604", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0348", "pat-0369", "pat-0868", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "RDP TPKT header", "PostgreSQL startup", "ET H.323 setup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0348", "pat-0369", "pat-0868", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "oracle", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "94587d9c9076679a8c562b25ae8654a3", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 1521, "service": "oracle", "service_name": "oracle", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003\ufffd]Y\ufffdBS\ufffd-\ufffd\ufffd\ufffd\u0015\ufffd\u073eq\ufffd\ufffd\u001e\ufffd(\ufffd\u001d\ufffd5\u0018\ufffdKM\u0000\r \ufffd\ufffdc\ufffd\u0000-\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffdIaA8`Q\ufffdk$\ufffd\ufffd\ufffd1R\ufffd\u000bN\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003\ufffd]Y\ufffdBS\ufffd-\ufffd\ufffd\ufffd\u0015\ufffd\u073eq\ufffd\ufffd\u001e\ufffd(\ufffd\u001d\ufffd5\u0018\ufffdKM\u0000\r \ufffd\ufffdc\ufffd\u0000-\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffdIaA8`Q\ufffdk$\ufffd\ufffd\ufffd1R\ufffd\u000bN\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u000b\n\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0003\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 L\ufffdhN\ufffd\r\u000e\ufffd\ufffdu4EW\ufffd\u035d", "payload_snippet": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003\ufffd]Y\ufffdBS\ufffd-\ufffd\ufffd\ufffd\u0015\ufffd\u073eq\ufffd\ufffd\u001e\ufffd(\ufffd\u001d\ufffd5\u0018\ufffdKM\u0000\r \ufffd\ufffdc\ufffd\u0000-\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffdIaA8`Q\ufffdk$\ufffd\ufffd\ufffd1R\ufffd\u000bN\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cc8bf33ae874c0625e258c28a8c00fefb58f05f4", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003\ufffd]Y\ufffdBS\ufffd-\ufffd\ufffd\ufffd\u0015\ufffd\u073eq\ufffd\ufffd\u001e\ufffd(\ufffd\u001d\ufffd5\u0018\ufffdKM\u0000\r \ufffd\ufffdc\ufffd\u0000-\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffdIaA8`Q\ufffdk$\ufffd\ufffd\ufffd1R\ufffd\u000bN\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011", "port": 1521, "service": "oracle", "service_label_fr": "ORACLE" }, "evidence_snippet": "\ufffd]Y\ufffdBS\ufffd-\ufffd\ufffd\ufffd\ufffd\u073eq\ufffd\ufffd\ufffd(\ufffd\ufffd5\ufffdKM\r \ufffd\ufffdc\ufffd-\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdIaA8`Q\ufffdk$\ufffd\ufffd\ufffd1R\ufffdN<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\ufffd\n\ufffd$\ufffd(\ufffd#\ufffd'<=\ufffd\ufffd", "attack_vector": "postgres probe \u00b7 via ORACLE:1521 \u00b7 (sonde \/ probe)", "target_port_label": "1521 \u00b7 ORACLE", "emulator_service": "oracle", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 35, "risk_label": "Faible", "service_name": "oracle", "service_label_fr": "ORACLE", "dst_port": 1521, "protocol_emulated": true, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-oracle", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003\ufffd]Y\ufffdBS\ufffd-\ufffd\ufffd\ufffd\u0015\ufffd\u073eq\ufffd\ufffd\u001e\ufffd(\ufffd\u001d\ufffd5\u0018\ufffdKM\u0000\r \ufffd\ufffdc\ufffd\u0000-\ufffd\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffdIaA8`Q\ufffdk$\ufffd\ufffd\ufffd1R\ufffd\u000bN\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011", "port": 1521, "service": "oracle", "service_label_fr": "ORACLE" }, "attack_vector": "postgres probe \u00b7 via ORACLE:1521 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd]Y\ufffdBS\ufffd-\ufffd\ufffd\ufffd\ufffd\u073eq\ufffd\ufffd\ufffd(\ufffd\ufffd5\ufffd*KM\r \ufffd\ufffdc\ufffd-\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdIaA8`Q\ufffdk$\ufffd\ufffd\ufffd1R\ufffdN<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\ufffd\n\ufffd$\ufffd(\ufffd#\ufffd'<=\ufffd\ufffd", "target_port_label": "1521 \u00b7 ORACLE", "emulator_service": "oracle", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "oracle", "service_banner": "honeypot-oracle", "service_os": "linux", "dst_port": "1521" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "195.96.139.0\/24", "coordinated_ip_count": 5, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_oracle_tns_probe", "oracle_emulated", "oracle_payload", "tls_clienthello" ] }
13/10/2026 00:20:01 UTC	TCP	1521 · ORACLE	oracle	Sonde Oracle TNS oracle tns probe · via ORACLE:1521 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur ORACLE WAF — Recommandation Surveiller Tags net_oracle_tns_probe oracle_emulated oracle_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1521 Chemin / cible — Service ORACLE Payload 2�,A^mZ$$@tG Pourquoi cette classification : Type « oracle_tns_probe » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) 2�,A^mZ$$@tG Meta JSON brut { "protocol_emulated": true, "emulator_response": "001f002e0000060000000000280000000c41434345505428444541444245454629", "emulator_response_len": 33, "bytes_in": 50, "payload_entropy": 3.8495490535693033, "port_category": "registered", "org": "Driftnet Ltd", "service": "oracle", "app_proto": "oracle", "asn": 211298, "country": "GB", "dst_port": 1521, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "6ae991b50c5b39ecc1e4f95d7240d75e52b8c353", "event_fingerprint": "5e232d65a022f2a64f918c38abebffe661d59604", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 10 }, "service_name": "oracle", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c4a6add3811b59fccab30a96ca3fb8d3", "path_pattern_hash": "420e91c120535c16728a9791d446fafc" }, "target_context": { "dst_port": 1521, "service": "oracle", "service_name": "oracle", "risk_score": 45 }, "payload_preview": "\u00002\ufffd\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G", "request_sample": "\u00002\ufffd\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G", "payload_snippet": "\u00002\ufffd\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G", "evidence": { "request_sample": "\u00002\ufffd\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G", "payload_snippet": "\u00002\ufffd\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G", "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c823682e4b5ded3a66f9d6ef3b3a540e5342ae71", "protocol_details": { "payload_preview": "\u00002\ufffd\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G", "port": 1521, "service": "oracle", "service_label_fr": "ORACLE" }, "evidence_snippet": "2\ufffd,A^mZ$$@tG", "attack_vector": "oracle tns probe \u00b7 via ORACLE:1521 \u00b7 (sonde \/ probe)", "target_port_label": "1521 \u00b7 ORACLE", "emulator_service": "oracle", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 45, "risk_label": "Moyen", "service_name": "oracle", "service_label_fr": "ORACLE", "dst_port": 1521, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-oracle", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u00002\ufffd\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G", "port": 1521, "service": "oracle", "service_label_fr": "ORACLE" }, "attack_vector": "oracle tns probe \u00b7 via ORACLE:1521 \u00b7 (sonde \/ probe)", "evidence_snippet": "2\ufffd,A^mZ$$@tG", "target_port_label": "1521 \u00b7 ORACLE", "emulator_service": "oracle", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "oracle", "service_banner": "honeypot-oracle", "service_os": "linux", "dst_port": "1521" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "195.96.139.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_oracle_tns_probe", "oracle_emulated", "oracle_payload" ] }
12/10/2026 17:21:06 UTC	TCP	1801 · MSMQ	msmq	Sonde MSMQ msmq probe · via MSMQ:1801 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSMQ WAF — Recommandation Surveiller Tags msmq_emulated msmq_payload net_msmq_probe socks4_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1801 Chemin / cible — Service MSMQ Payload yh�`�P Pourquoi cette classification : Type « msmq_probe » (signaux protocolaires) · confiance 0% Confiance classification 10% Corrélation +10 Risque capteur Faible · 24 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) yh�`�P Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206d736d7120726561647920706f72743d313830310d0a", "emulator_response_len": 35, "bytes_in": 9, "payload_entropy": 3.169925001442312, "port_category": "registered", "org": "Driftnet Ltd", "service": "msmq", "app_proto": "msmq", "asn": 211298, "country": "GB", "dst_port": 1801, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 24, "tag_count": 4, "anomaly_count": 0, "campaign_key": "6977b3b8692994398bb84c17d96961c665911b0e", "event_fingerprint": "afcd0bcecf9e89348e406006fc3c234988ff7cb9", "classification_reason": "Type \u00ab msmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.1, "classification_confidence": 0.1, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 24, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "msmq", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "02162ad384c61bc56b9f02f8fb455998", "path_pattern_hash": "d66e165302e20ebfa98b6de5c5f2bccc" }, "target_context": { "dst_port": 1801, "service": "msmq", "service_name": "msmq", "risk_score": 24 }, "payload_preview": "\u0004\u0001yh\ufffd`\ufffdP\u0000", "request_sample": "\u0004\u0001yh\ufffd`\ufffdP\u0000", "payload_snippet": "\u0004\u0001yh\ufffd`\ufffdP\u0000", "evidence": { "request_sample": "\u0004\u0001yh\ufffd`\ufffdP\u0000", "payload_snippet": "\u0004\u0001yh\ufffd`\ufffdP\u0000", "classification_reason": "Type \u00ab msmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a882c878cd60d9a9e86a88f9c255e5b12dda398b", "protocol_details": { "payload_preview": "\u0004\u0001yh\ufffd`\ufffdP\u0000", "port": 1801, "service": "msmq", "service_label_fr": "MSMQ" }, "evidence_snippet": "yh\ufffd`\ufffdP", "attack_vector": "msmq probe \u00b7 via MSMQ:1801 \u00b7 (sonde \/ probe)", "target_port_label": "1801 \u00b7 MSMQ", "emulator_service": "msmq", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab msmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab msmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 10, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 24, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 24, "risk_label": "Faible", "service_name": "msmq", "service_label_fr": "MSMQ", "dst_port": 1801, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-msmq", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0004\u0001yh\ufffd`\ufffdP\u0000", "port": 1801, "service": "msmq", "service_label_fr": "MSMQ" }, "attack_vector": "msmq probe \u00b7 via MSMQ:1801 \u00b7 (sonde \/ probe)", "evidence_snippet": "yh\ufffd`\ufffdP", "target_port_label": "1801 \u00b7 MSMQ", "emulator_service": "msmq", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "msmq", "service_banner": "honeypot-msmq", "service_os": "linux", "dst_port": "1801" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "195.96.139.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "msmq_emulated", "msmq_payload", "net_msmq_probe", "socks4_greeting" ] }
12/10/2026 17:21:03 UTC	TCP	1801 · MSMQ	msmq	Sonde MSMQ msmq probe · via MSMQ:1801 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur MSMQ WAF — Recommandation Surveiller Tags msmq_emulated msmq_payload net_msmq_probe socks5_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1801 Chemin / cible — Service MSMQ Payload Pourquoi cette classification : Type « msmq_probe » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206d736d7120726561647920706f72743d313830310d0a", "emulator_response_len": 35, "bytes_in": 3, "payload_entropy": 1.584962500721156, "port_category": "registered", "org": "Driftnet Ltd", "service": "msmq", "app_proto": "msmq", "asn": 211298, "country": "GB", "dst_port": 1801, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 4, "anomaly_count": 0, "campaign_key": "fa139e830edd6c32697bba34a6056fd7cd556f29", "event_fingerprint": "afcd0bcecf9e89348e406006fc3c234988ff7cb9", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab msmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35, "correlation_boost": 10 }, "service_name": "msmq", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "da075e9d699084fc189cdd233081c49f", "path_pattern_hash": "d66e165302e20ebfa98b6de5c5f2bccc" }, "target_context": { "dst_port": 1801, "service": "msmq", "service_name": "msmq", "risk_score": 35 }, "payload_preview": "\u0005\u0001\u0000", "request_sample": "\u0005\u0001\u0000", "payload_snippet": "\u0005\u0001\u0000", "evidence": { "request_sample": "\u0005\u0001\u0000", "payload_snippet": "\u0005\u0001\u0000", "classification_reason": "Type \u00ab msmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8caa292f62d3b2feb1bc9145fb0f1bed2e7ef626", "protocol_details": { "payload_preview": "\u0005\u0001\u0000", "port": 1801, "service": "msmq", "service_label_fr": "MSMQ" }, "attack_vector": "msmq probe \u00b7 via MSMQ:1801 \u00b7 (sonde \/ probe)", "target_port_label": "1801 \u00b7 MSMQ", "emulator_service": "msmq", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab msmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab msmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 35, "risk_label": "Faible", "service_name": "msmq", "service_label_fr": "MSMQ", "dst_port": 1801, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-msmq", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0005\u0001\u0000", "port": 1801, "service": "msmq", "service_label_fr": "MSMQ" }, "attack_vector": "msmq probe \u00b7 via MSMQ:1801 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1801 \u00b7 MSMQ", "emulator_service": "msmq", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "msmq", "service_banner": "honeypot-msmq", "service_os": "linux", "dst_port": "1801" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "195.96.139.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "msmq_emulated", "msmq_payload", "net_msmq_probe", "socks5_greeting" ] }
12/10/2026 04:34:34 UTC	TCP	9300 · ELASTICSEARCH TRANSPORT	elasticsearch-transport	Transport Elasticsearch (9300) elasticsearch transport · via ELASTICSEARCH TRANSPORT:9300 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur ELASTICSEARCH-TRANSPORT WAF — Recommandation Surveiller Tags elasticsearch_tcp_probe elasticsearch_transport elasticsearch_transport_emulated elasticsearch_transport_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9300 Chemin / cible — Service ELASTICSEARCH TRANSPORT Payload 2�,A^mZ$$@tG Pourquoi cette classification : Type « elasticsearch_transport » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) 2�,A^mZ$$@tG Meta JSON brut { "protocol_emulated": true, "emulator_response": "45530000002d0000000000000000000000000000000000000000000000000000000000000000000000000000000000372e31372e3900", "emulator_response_len": 54, "bytes_in": 50, "payload_entropy": 3.8495490535693033, "port_category": "registered", "org": "Driftnet Ltd", "service": "elasticsearch-transport", "app_proto": "elasticsearch-transport", "asn": 211298, "country": "GB", "dst_port": 9300, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 10 }, "risk_score": 45, "tag_count": 5, "anomaly_count": 0, "campaign_key": "2317fb6ddfd6d10274000f3e57e681e8f806b001", "event_fingerprint": "aad0d781effe2e4d309b103f88518db066a812e6", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab elasticsearch_transport \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 10, "risk_score": 45, "correlation_boost": 10 }, "service_name": "elasticsearch-transport", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c4a6add3811b59fccab30a96ca3fb8d3", "path_pattern_hash": "26de86257e6512eeb528caaeaa778131" }, "target_context": { "dst_port": 9300, "service": "elasticsearch-transport", "service_name": "elasticsearch-transport", "risk_score": 45 }, "payload_preview": "\u00002\ufffd\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G", "request_sample": "\u00002\ufffd\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G", "payload_snippet": "\u00002\ufffd\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G", "evidence": { "request_sample": "\u00002\ufffd\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G", "payload_snippet": "\u00002\ufffd\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G", "classification_reason": "Type \u00ab elasticsearch_transport \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "105acc96fba8acced86301e9a5636cf776723d8f", "protocol_details": { "payload_preview": "\u00002\ufffd\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G", "port": 9300, "service": "elasticsearch-transport", "service_label_fr": "ELASTICSEARCH TRANSPORT" }, "evidence_snippet": "2\ufffd,A^mZ$$@tG", "attack_vector": "elasticsearch transport \u00b7 via ELASTICSEARCH TRANSPORT:9300 \u00b7 (sonde \/ probe)", "target_port_label": "9300 \u00b7 ELASTICSEARCH TRANSPORT", "emulator_service": "elasticsearch-transport", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab elasticsearch_transport \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab elasticsearch_transport \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 10, "risk_score": 45, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 45, "risk_label": "Moyen", "service_name": "elasticsearch-transport", "service_label_fr": "ELASTICSEARCH TRANSPORT", "dst_port": 9300, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-elasticsearch-transport", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u00002\ufffd\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G", "port": 9300, "service": "elasticsearch-transport", "service_label_fr": "ELASTICSEARCH TRANSPORT" }, "attack_vector": "elasticsearch transport \u00b7 via ELASTICSEARCH TRANSPORT:9300 \u00b7 (sonde \/ probe)", "evidence_snippet": "2\ufffd,A^mZ$$@tG", "target_port_label": "9300 \u00b7 ELASTICSEARCH TRANSPORT", "emulator_service": "elasticsearch-transport", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "elasticsearch_transport", "service_banner": "honeypot-elasticsearch-transport", "service_os": "linux", "dst_port": "9300" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "195.96.139.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "elasticsearch_tcp_probe", "elasticsearch_transport", "elasticsearch_transport_emulated", "elasticsearch_transport_payload", "net_elasticsearch_transport" ] }
12/10/2026 03:49:15 UTC	TCP	7676 · TLS	tls	Sonde TLS tls probe · via TLS:7676 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole JA3 a7da2bc4375750ea Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7676 Chemin / cible — Service TLS Payload ��?�r�q �tJ��_b�FQ�@�a:>�� u��#�i�:�k�;�� r?��+�,�/�0̨̩��@+ Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��?�r�q �tJ��_b�FQ�@�a:>�� u��#�i�:�k�;��r?��+�,�/�0̨̩��@+ Requête brute (extrait) ��?�r�q �tJ��_b�FQ�@�a:>�� u��#�i�:�k�;�� r?��+�,�/�0̨̩��@+ http/1.1h2�# Meta JSON brut { "tls_ja3_hash": "a7da2bc4375750ea67e9e97d561b1fdd", "tls_sni": null, "tls_alpn": [ "http\/1.1", "h2" ], "bytes_in": 162, "payload_entropy": 5.644349790149694, "port_category": "registered", "org": "Driftnet Ltd", "service": "tls", "app_proto": "tls", "asn": 211298, "country": "GB", "dst_port": 7676, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c9ce4a9b9492f8b7834ed1ea6e8b773badac22fc", "event_fingerprint": "aa63a01b266cfcf74db5980e324c1cab80b17ad1", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "a7da2bc4375750ea67e9e97d561b1fdd", "payload_hash": "c46a5aeabfb340d939f5ed3739b4f83d", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "f3504069efddbf2644c62545ebe546be", "tls_version": "0x0303", "tls_cipher_count": 8, "ja3_client_category": "nmap_scanner" }, "tls_ja3": "771,49195-49196-49199-49200-52393-52392-156-157,43-10-13-16-23-22-65281-35,23-29,", "tls_ja4_hash": "f3504069efddbf2644c62545ebe546be", "tls_ja4": "t13d0108_94ebcd170458_257101d612d5", "tls_version": "0x0303", "tls_cipher_count": 8, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 7676, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003?\ufffd\u0005\u0019r\ufffdq\r\ufffdt\u001bJ\ufffd\ufffd\ufffd_b\ufffdF\u000fQ\ufffd@\ufffda:>\ufffd\ufffd\ufffd \ufffd\ufffd\nu\ufffd\ufffd\ufffd\ufffd#\u0006\ufffdi\ufffd\u0013:\ufffdk\ufffd;\ufffd\ufffd\ufffd\ufffd\u000b\b\ufffdr?\u0007\ufffd\u0000\u0010\ufffd+\ufffd,\ufffd\/\ufffd0\u0329\u0328\u0000\ufffd\u0000\ufffd\u0001\u0000\u0000@\u0000+\u0000\u0003\u0002\u0003\u0003\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u001d\u0000\r\u0000\b\u0000\u0006\u0004\u0003\b\u0004\u0004\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003?\ufffd\u0005\u0019r\ufffdq\r\ufffdt\u001bJ\ufffd\ufffd\ufffd_b\ufffdF\u000fQ\ufffd@\ufffda:>\ufffd\ufffd\ufffd \ufffd\ufffd\nu\ufffd\ufffd\ufffd\ufffd#\u0006\ufffdi\ufffd\u0013:\ufffdk\ufffd;\ufffd\ufffd\ufffd\ufffd\u000b\b\ufffdr?\u0007\ufffd\u0000\u0010\ufffd+\ufffd,\ufffd\/\ufffd0\u0329\u0328\u0000\ufffd\u0000\ufffd\u0001\u0000\u0000@\u0000+\u0000\u0003\u0002\u0003\u0003\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u001d\u0000\r\u0000\b\u0000\u0006\u0004\u0003\b\u0004\u0004\u0001\u0000\u0010\u0000\u000e\u0000\f\bhttp\/1.1\u0002h2\u0000\u0017\u0000\u0000\u0000\u0016\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000#\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003?\ufffd\u0005\u0019r\ufffdq\r\ufffdt\u001bJ\ufffd\ufffd\ufffd_b\ufffdF\u000fQ\ufffd@\ufffda:>\ufffd\ufffd\ufffd \ufffd\ufffd\nu\ufffd\ufffd\ufffd\ufffd#\u0006\ufffdi\ufffd\u0013:\ufffdk\ufffd;\ufffd\ufffd\ufffd\ufffd\u000b\b\ufffdr?\u0007\ufffd\u0000\u0010\ufffd+\ufffd,\ufffd\/\ufffd0\u0329\u0328\u0000\ufffd\u0000\ufffd\u0001\u0000\u0000@\u0000+\u0000\u0003\u0002\u0003\u0003\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u001d\u0000\r\u0000\b\u0000\u0006\u0004\u0003\b\u0004\u0004\u0001\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f8b2ba0b412581a9429031d24ad033274350e471", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003?\ufffd\u0005\u0019r\ufffdq\r\ufffdt\u001bJ\ufffd\ufffd\ufffd_b\ufffdF\u000fQ\ufffd@\ufffda:>\ufffd\ufffd\ufffd \ufffd\ufffd\nu\ufffd\ufffd\ufffd\ufffd#\u0006\ufffdi\ufffd\u0013:\ufffdk\ufffd;\ufffd\ufffd\ufffd\ufffd\u000b\b\ufffdr?\u0007\ufffd\u0000\u0010\ufffd+\ufffd,\ufffd\/\ufffd0\u0329\u0328\u0000\ufffd\u0000\ufffd\u0001\u0000\u0000@\u0000+\u0000\u0003\u0002\u0003\u0003\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u001d\u0000\r\u0000\b\u0000\u0006\u0004\u0003\b\u0004\u0004\u0001\u0000", "tls_ja3": "a7da2bc4375750ea67e9e97d561b1fdd", "tls_ja4": "f3504069efddbf2644c62545ebe546be", "port": 7676, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd?\ufffdr\ufffdq\r\ufffdtJ\ufffd\ufffd\ufffd_b\ufffdFQ\ufffd@\ufffda:>\ufffd\ufffd\ufffd \ufffd\ufffd\nu\ufffd\ufffd\ufffd\ufffd#\ufffdi\ufffd:\ufffdk\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffdr?\ufffd\ufffd+\ufffd,\ufffd\/\ufffd0\u0329\u0328\ufffd\ufffd@+", "attack_vector": "tls probe \u00b7 via TLS:7676 \u00b7 (sonde \/ probe)", "target_port_label": "7676 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7676, "protocol_emulated": null, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003?\ufffd\u0005\u0019r\ufffdq\r\ufffdt\u001bJ\ufffd\ufffd\ufffd_b\ufffdF\u000fQ\ufffd@\ufffda:>\ufffd\ufffd\ufffd \ufffd\ufffd\nu\ufffd\ufffd\ufffd\ufffd#\u0006\ufffdi\ufffd\u0013:\ufffdk\ufffd;\ufffd\ufffd\ufffd\ufffd\u000b\b\ufffdr?\u0007\ufffd\u0000\u0010\ufffd+\ufffd,\ufffd\/\ufffd0\u0329\u0328\u0000\ufffd\u0000\ufffd\u0001\u0000\u0000@\u0000+\u0000\u0003\u0002\u0003\u0003\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u001d\u0000\r\u0000\b\u0000\u0006\u0004\u0003\b\u0004\u0004\u0001\u0000", "tls_ja3": "a7da2bc4375750ea67e9e97d561b1fdd", "tls_ja4": "f3504069efddbf2644c62545ebe546be", "port": 7676, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:7676 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd?\ufffdr\ufffdq\r\ufffdtJ\ufffd\ufffd\ufffd_b\ufffdFQ\ufffd@\ufffda:>\ufffd\ufffd\ufffd \ufffd\ufffd\nu\ufffd\ufffd\ufffd\ufffd#\ufffdi\ufffd:\ufffdk\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffdr?\ufffd\ufffd+\ufffd,\ufffd\/\ufffd0\u0329\u0328\ufffd\ufffd@+", "target_port_label": "7676 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7676" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "195.96.139.0\/24", "coordinated_ip_count": 5, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
12/10/2026 00:03:23 UTC	TCP	7170	—	Sonde port 7170 Sonde port · port 7170 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7170 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Driftnet Ltd", "service": null, "app_proto": null, "asn": 211298, "country": "GB", "dst_port": 7170, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "34b900656ca0fcfdfed9a2771a292a554bfe9ee4", "event_fingerprint": "6f8d2a8db3a126979ed6028e8dab420c269d62a4", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 10 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 211298, "org": "Driftnet Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 7170, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5ab15c9ffc099b83a22013a276da2274353589c1", "protocol_details": { "port": 7170 }, "attack_vector": "Sonde port \u00b7 port 7170 \u00b7 (sonde \/ probe)", "target_port_label": "7170", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 7170, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "port": 7170 }, "attack_vector": "Sonde port \u00b7 port 7170 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "7170", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (195.96.139.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "7170" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "195.96.139.0\/24", "coordinated_ip_count": 5, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "behavior_alert_count": 1, "behavior_priority": 84 }

195.96.139.80

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence