31/07/2026 12:39:39 UTC
TCP
177 · HTTP
Scan de ports
port scan syn · via HTTP:177 · (reconnaissance) · → /v1/messages
Élevée
Élevé · 66
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950316:lfi-14
950319:lfi-14
950468:nosqli-3
950470:nosqli-3
Cible HTTP
POST
/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
177
Chemin / cible
/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
anthro
Requête brute (extrait)
POST /v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 175 Accept-Encoding: gzip, compress, deflate, br Host: 62.3
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "35def72dfb9b076fe79dbd3d4776154e9fb9664d",
"http_target_hash": "db019ad17e38ba897d71591e9e52878ec973496c",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 445,
"payload_entropy": 5.199007827090349,
"port_category": "well_known",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 177,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "1c650946024650444b284fb2e383421fb30beb18",
"event_fingerprint": "06f94e241bd6f164ae64bb376718432deb6d51e1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "585a5cf50a4cac24e1e7ea90a2b2849a",
"path_pattern_hash": "c64fb925aa64878f95c3f56184f77f2c"
},
"target_context": {
"dst_port": 177,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950319:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 175\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"evidence": {
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950319:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 175\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "99ff0ed6108096aa3bb05c6529c2c7dbe88192e7",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 177,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"attack_vector": "port scan syn \u00b7 via HTTP:177 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"target_port_label": "177 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 177,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 177,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:177 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"target_port_label": "177 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "177"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.38,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950319:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:39 UTC
TCP
1207 · HTTP
Scan de ports
port scan syn · via HTTP:1207 · (reconnaissance) · → /anthropic/messages
Élevée
Moyen · 52
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/messages UA axios/1.18.1
Émulateur
HTTP
WAF
12
Recommandation
Investiguer
Tags
950468:nosqli-3
950470:nosqli-3
http_jwt_body
http_mass_assignment
Cible HTTP
POST
/anthropic/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
1207
Chemin / cible
/anthropic/messages
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 52
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
nosqli-3
Payload (extrait)
POST /anthropic/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /anthropic/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 199 Accept-Encoding: gzip, compress, deflate, br Hos
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "f3dc7b1e8742ef425fa4df89199a472507074d2f",
"http_target_hash": "43e7caacf9ef14cae77115b86fe870c4267ea7ba",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 477,
"payload_entropy": 5.21716190021751,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 1207,
"risk_waf": 56,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "0eb945a093ff70ff185082481f64610d1cad4313",
"event_fingerprint": "02e029f5211e7c8a50e7c120565f1873079d9617",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "999813c147cf17aae89d00fc12551ec6",
"path_pattern_hash": "134c8c19df8466a0488f4d696bc0689f"
},
"target_context": {
"dst_port": 1207,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r",
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9d82555421b5cb2a24edad77d8424f0d52a28d18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 1207,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:1207 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"target_port_label": "1207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1207,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 1207,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:1207 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "1207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 56 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1207"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.37,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"http_jwt_body",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:39 UTC
TCP
9595 · HTTP
Scan de ports
port scan syn · via HTTP:9595 · (reconnaissance) · → /anthropic/messages
Élevée
Moyen · 49
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/messages UA axios/1.18.1
Émulateur
HTTP
WAF
12
Recommandation
Surveiller
Tags
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9595
Chemin / cible
/anthropic/messages
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 49
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
nosqli-3
Payload (extrait)
POST /anthropic/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /anthropic/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 172 Accept-Encoding: gzip, compress, deflate, br Hos
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "b57fc7370a8982e7e128ad5ab98a7de5ce0ef67d",
"http_target_hash": "43e7caacf9ef14cae77115b86fe870c4267ea7ba",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 450,
"payload_entropy": 5.207035616979983,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 9595,
"risk_waf": 56,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 49,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "3b65ec125f87086420dcc7d31227d03f3fae84d1",
"event_fingerprint": "fe22589376d9f9c099e3477bb87b5f832addd074",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 49,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "5b218996d93266017d1f1e71181bfaba",
"path_pattern_hash": "134c8c19df8466a0488f4d696bc0689f"
},
"target_context": {
"dst_port": 9595,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r",
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 172\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 172\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a0506414aeb1ba34ce294c4b190a8c0cb8eef1b2",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 9595,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:9595 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"target_port_label": "9595 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 49,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9595,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 9595,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9595 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "9595 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 56 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9595"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.36,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:39 UTC
TCP
480 · HTTP
Scan de ports
port scan syn · via HTTP:480 · (reconnaissance) · → /anthropic/v1/messages
Élevée
Moyen · 61
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_jwt_body
Cible HTTP
POST
/anthropic/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
480
Chemin / cible
/anthropic/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /anthropic/v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: clo
Requête brute (extrait)
POST /anthropic/v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 199 Accept-Encoding: gzip, compress, deflate, br
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "6b0c3d7d19976f022627aac29a5745e9dbed4d46",
"http_target_hash": "4c3e5d0e0a234b619263ba3580eef2a7e5434387",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 479,
"payload_entropy": 5.223641429907284,
"port_category": "well_known",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 480,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f0056c109ad21c6cd44efe2830482f446f331203",
"event_fingerprint": "956eba05aa838e4982f64bad88b5eea06c189eb3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "8f2e1cb379f7363c20305ca287b850b7",
"path_pattern_hash": "59a96edfcfb020a16f97294a554c1ccd"
},
"target_context": {
"dst_port": 480,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"evidence": {
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a443fc0e36ed49e9beb8a9dcd042bdc3da692dbc",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 480,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"attack_vector": "port scan syn \u00b7 via HTTP:480 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"target_port_label": "480 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 480,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 480,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:480 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"target_port_label": "480 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "480"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.36,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_jwt_body",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:39 UTC
TCP
10020 · HTTP
Scan de ports
port scan syn · via HTTP:10020 · (reconnaissance) · → /v1/messages
Élevée
Moyen · 59
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
10020
Chemin / cible
/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
anthro
Requête brute (extrait)
POST /v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 170 Accept-Encoding: gzip, compress, deflate, br Host: 62.3
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "d1a9810965e38e25dee856166934b89304e50f24",
"http_target_hash": "db019ad17e38ba897d71591e9e52878ec973496c",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 442,
"payload_entropy": 5.165608093613225,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 10020,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 59,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d8e9976d6b68c8b6f3af5c87e975d2986b4ada6e",
"event_fingerprint": "b57381860c9c83dad6ed444a806123a8350cc3d1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 59,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "4ca4afdca696b17ef5fd56cbe43bdd01",
"path_pattern_hash": "c64fb925aa64878f95c3f56184f77f2c"
},
"target_context": {
"dst_port": 10020,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 170\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"evidence": {
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 170\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6ed01b0f34afb14a2db28d0d5211f6679d49799f",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 10020,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"attack_vector": "port scan syn \u00b7 via HTTP:10020 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"target_port_label": "10020 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 59,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10020,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 10020,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:10020 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"target_port_label": "10020 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.35,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:39 UTC
TCP
25105 · HTTP
Scan de ports
port scan syn · via HTTP:25105 · (reconnaissance) · → /v1/messages
Élevée
Moyen · 62
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
25105
Chemin / cible
/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
anthro
Requête brute (extrait)
POST /v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 192 Accept-Encoding: gzip, compress, deflate, br Host: 62.3
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "db07f5a8a719154561900d2785dd5f880892c23b",
"http_target_hash": "db019ad17e38ba897d71591e9e52878ec973496c",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 464,
"payload_entropy": 5.228320728260285,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 25105,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f9fc996b0dfe83628d0895436002550f8b61c7b1",
"event_fingerprint": "89ac1029435c2a613df68b40164ba93deb00abce",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "0c011537baa0dbd7017f6ec684e45a1c",
"path_pattern_hash": "c64fb925aa64878f95c3f56184f77f2c"
},
"target_context": {
"dst_port": 25105,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 192\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"evidence": {
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 192\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "089fae5b9439650c99e8f018f88f77b4bf82d803",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 25105,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"attack_vector": "port scan syn \u00b7 via HTTP:25105 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"target_port_label": "25105 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 25105,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 25105,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:25105 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"target_port_label": "25105 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "25105"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.34,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:39 UTC
TCP
3500 · HTTP
Scan de ports
port scan syn · via HTTP:3500 · (reconnaissance) · → /anthropic/v1/messages
Élevée
Moyen · 62
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3500
Chemin / cible
/anthropic/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /anthropic/v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: clo
Requête brute (extrait)
POST /anthropic/v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 169 Accept-Encoding: gzip, compress, deflate, br
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "8e9e5fcc91a795f8d10bb7233e483121ca7c7a63",
"http_target_hash": "4c3e5d0e0a234b619263ba3580eef2a7e5434387",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 450,
"payload_entropy": 5.199618350043919,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 3500,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a75a89f7c72cb5321f9867538a6531828c0b3f96",
"event_fingerprint": "34462e5f645e1d55a0c695f2341c8f31f6b3cde1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "2d197e64d9ec8920240be13c55ceadff",
"path_pattern_hash": "59a96edfcfb020a16f97294a554c1ccd"
},
"target_context": {
"dst_port": 3500,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 169\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"evidence": {
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 169\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9187b54fec7f87e458339dedd6d42d01c92bc5ab",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 3500,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"attack_vector": "port scan syn \u00b7 via HTTP:3500 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"target_port_label": "3500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3500,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 3500,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3500 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"target_port_label": "3500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3500"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.34,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:39 UTC
TCP
2250 · HTTP
Scan de ports
port scan syn · via HTTP:2250 · (reconnaissance) · → /anthropic/v1/messages
Élevée
Moyen · 61
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2250
Chemin / cible
/anthropic/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /anthropic/v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: clo
Requête brute (extrait)
POST /anthropic/v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 180 Accept-Encoding: gzip, compress, deflate, br
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "03b00cf58928fc47b2ea2c23bb46c8c88762ef4e",
"http_target_hash": "4c3e5d0e0a234b619263ba3580eef2a7e5434387",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 461,
"payload_entropy": 5.202983451646831,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 2250,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 61,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "21267636895165d18531ea489ed7768a64efdf6a",
"event_fingerprint": "a7bec42d5292aa7186fd1a8edbd24d8df5747e95",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 61,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "ddd3f0508412cd4ea9f928e782f2d3f5",
"path_pattern_hash": "59a96edfcfb020a16f97294a554c1ccd"
},
"target_context": {
"dst_port": 2250,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"evidence": {
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "73ee547dba1adedd8d8b31df84dfc8b63aaa958d",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 2250,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"attack_vector": "port scan syn \u00b7 via HTTP:2250 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"target_port_label": "2250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 61,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2250,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 2250,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:2250 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"target_port_label": "2250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2250"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.33,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:35 UTC
TCP
177 · HTTP
Scan de ports
port scan syn · via HTTP:177 · (reconnaissance) · → /v1/chat/completions
Élevée
Élevé · 76
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/chat/completions UA axios/1.18.1
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950316:lfi-14
950319:lfi-14
950468:nosqli-3
950470:nosqli-3
Cible HTTP
POST
/v1/chat/completions
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
177
Chemin / cible
/v1/chat/completions
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 76
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/chat/completions HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/chat/completions HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /v1/chat/completions HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close User-Agent: axios/1.18.1 Content-Length: 268 Accept-Encoding: gzip, compress, deflate, br Host: 62.3.50.33:177 {"model":
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "35def72dfb9b076fe79dbd3d4776154e9fb9664d",
"http_target_hash": "677ecf6c8ea5590ca72079d2c8422b224d690b39",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 515,
"payload_entropy": 5.1398245224956325,
"port_category": "well_known",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 177,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 76,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "9479e94fe2de48fd8ec68a7b49977c51c2bc173f",
"event_fingerprint": "5d5ac9e9d1fe19ac3f7d785b22940ad6acc78a40",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 76,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "501c21b9cd4a63a39961c65546a3404a",
"path_pattern_hash": "2e3b96fc129d494b171c50c85551ee22"
},
"target_context": {
"dst_port": 177,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950319:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 268\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:177\r\n\r\n{\"model\":",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950319:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 268\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:177\r\n\r\n{\"model\":",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cf92e0bcf5418df24035f7a0f7b9eda6f9f1b777",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 177,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:177 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"target_port_label": "177 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 76,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 177,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 177,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:177 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "177 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "177"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.74,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950319:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_llm_api_scrape",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:35 UTC
TCP
480 · HTTP
Scan de ports
port scan syn · via HTTP:480 · (reconnaissance) · → /v1/messages
Élevée
Moyen · 61
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_jwt_body
Cible HTTP
POST
/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
480
Chemin / cible
/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
anthro
Requête brute (extrait)
POST /v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 199 Accept-Encoding: gzip, compress, deflate, br Host: 62.3
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "6b0c3d7d19976f022627aac29a5745e9dbed4d46",
"http_target_hash": "db019ad17e38ba897d71591e9e52878ec973496c",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 469,
"payload_entropy": 5.229342218085738,
"port_category": "well_known",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 480,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f0056c109ad21c6cd44efe2830482f446f331203",
"event_fingerprint": "a90318b96d425163c5b43132a86102dd8ed2af01",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "9ef8b576da5649709f13a2562baa46bf",
"path_pattern_hash": "c64fb925aa64878f95c3f56184f77f2c"
},
"target_context": {
"dst_port": 480,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"evidence": {
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fb6818f39984d4eb34aa40af9d88fc163aa45c64",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 480,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"attack_vector": "port scan syn \u00b7 via HTTP:480 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"target_port_label": "480 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 480,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 480,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:480 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"target_port_label": "480 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "480"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.73,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_jwt_body",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:35 UTC
TCP
2250 · HTTP
Scan de ports
port scan syn · via HTTP:2250 · (reconnaissance) · → /v1/messages
Élevée
Moyen · 61
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2250
Chemin / cible
/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
anthro
Requête brute (extrait)
POST /v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 180 Accept-Encoding: gzip, compress, deflate, br Host: 62.3
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "03b00cf58928fc47b2ea2c23bb46c8c88762ef4e",
"http_target_hash": "db019ad17e38ba897d71591e9e52878ec973496c",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 451,
"payload_entropy": 5.208956056608902,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 2250,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 61,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "21267636895165d18531ea489ed7768a64efdf6a",
"event_fingerprint": "d80e5971a9bc76b5f67d96124b32eaef36ad8904",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 61,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "d5392a6e5363e60187b03a604e915664",
"path_pattern_hash": "c64fb925aa64878f95c3f56184f77f2c"
},
"target_context": {
"dst_port": 2250,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"evidence": {
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0f633c0e175447277524d014a8ef43a583d3f0ff",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 2250,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"attack_vector": "port scan syn \u00b7 via HTTP:2250 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"target_port_label": "2250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 61,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2250,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 2250,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:2250 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"target_port_label": "2250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2250"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.72,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:35 UTC
TCP
9595 · HTTP
Scan de ports
port scan syn · via HTTP:9595 · (reconnaissance) · → /anthropic/v1/messages
Élevée
Moyen · 60
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9595
Chemin / cible
/anthropic/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /anthropic/v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: clo
Requête brute (extrait)
POST /anthropic/v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 172 Accept-Encoding: gzip, compress, deflate, br
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "b57fc7370a8982e7e128ad5ab98a7de5ce0ef67d",
"http_target_hash": "4c3e5d0e0a234b619263ba3580eef2a7e5434387",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 453,
"payload_entropy": 5.2144289487994415,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 9595,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 60,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "fbba59b3b8bee14315bdc48d24796437c5359238",
"event_fingerprint": "b5898d135d843f01da5e351ba3badd4089cf7ab7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 60,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "a6f7afa54acbec3901a2d3c4e383c9fb",
"path_pattern_hash": "59a96edfcfb020a16f97294a554c1ccd"
},
"target_context": {
"dst_port": 9595,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 172\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"evidence": {
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 172\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31307bbba437d3ab67d7203c4fb724a8296fd1b0",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 9595,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"attack_vector": "port scan syn \u00b7 via HTTP:9595 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"target_port_label": "9595 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 60,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9595,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 9595,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9595 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"target_port_label": "9595 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9595"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.71,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:35 UTC
TCP
10020 · HTTP
Scan de ports
port scan syn · via HTTP:10020 · (reconnaissance) · → /v1/chat/completions
Élevée
Élevé · 69
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/chat/completions UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_llm_api_scrape
Cible HTTP
POST
/v1/chat/completions
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
10020
Chemin / cible
/v1/chat/completions
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/chat/completions HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/chat/completions HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /v1/chat/completions HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close User-Agent: axios/1.18.1 Content-Length: 263 Accept-Encoding: gzip, compress, deflate, br Host: 62.3.50.33:10020 {"model
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "d1a9810965e38e25dee856166934b89304e50f24",
"http_target_hash": "677ecf6c8ea5590ca72079d2c8422b224d690b39",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 512,
"payload_entropy": 5.116241215143852,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 10020,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 69,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "38b1be4222d35dd10b3ab4021f8186ed8924af2b",
"event_fingerprint": "f7d583301b86fbda2f7b01239e8bd69fa4edfa14",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "579ce2247331f9b583877216bdabf5a1",
"path_pattern_hash": "2e3b96fc129d494b171c50c85551ee22"
},
"target_context": {
"dst_port": 10020,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 263\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:10020\r\n\r\n{\"model",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 263\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:10020\r\n\r\n{\"model",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b53c8c81176557ac5e89241d1cc9c31db4fe5f9f",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 10020,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:10020 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"target_port_label": "10020 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10020,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 10020,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:10020 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "10020 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.7,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_llm_api_scrape",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:35 UTC
TCP
3500 · HTTP
Scan de ports
port scan syn · via HTTP:3500 · (reconnaissance) · → /v1/messages
Élevée
Moyen · 62
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3500
Chemin / cible
/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
anthro
Requête brute (extrait)
POST /v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 169 Accept-Encoding: gzip, compress, deflate, br Host: 62.3
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "8e9e5fcc91a795f8d10bb7233e483121ca7c7a63",
"http_target_hash": "db019ad17e38ba897d71591e9e52878ec973496c",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 440,
"payload_entropy": 5.205701353664495,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 3500,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a75a89f7c72cb5321f9867538a6531828c0b3f96",
"event_fingerprint": "d494167b6896c8d3545350b3358f36a49c01a412",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "2077219accd1631a558ba8eb42f476c2",
"path_pattern_hash": "c64fb925aa64878f95c3f56184f77f2c"
},
"target_context": {
"dst_port": 3500,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 169\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"evidence": {
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 169\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bffad9469f93427c5571482ad981bbb3a30da533",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 3500,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"attack_vector": "port scan syn \u00b7 via HTTP:3500 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"target_port_label": "3500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3500,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 3500,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3500 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"target_port_label": "3500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3500"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.69,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:35 UTC
TCP
25105 · HTTP
Scan de ports
port scan syn · via HTTP:25105 · (reconnaissance) · → /v1/chat/completions
Élevée
Élevé · 73
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/chat/completions UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_llm_api_scrape
Cible HTTP
POST
/v1/chat/completions
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
25105
Chemin / cible
/v1/chat/completions
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 73
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/chat/completions HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/chat/completions HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /v1/chat/completions HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close User-Agent: axios/1.18.1 Content-Length: 285 Accept-Encoding: gzip, compress, deflate, br Host: 62.3.50.33:25105 {"model
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "db07f5a8a719154561900d2785dd5f880892c23b",
"http_target_hash": "677ecf6c8ea5590ca72079d2c8422b224d690b39",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 534,
"payload_entropy": 5.17815344308351,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 25105,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a2f68415c6c39f68c488001b32503be061de7331",
"event_fingerprint": "104cbe4ca4021dd7f1f57c1ea23d1ac56ab76bd6",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "d02e262791161bc5ff793414802fdb50",
"path_pattern_hash": "2e3b96fc129d494b171c50c85551ee22"
},
"target_context": {
"dst_port": 25105,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 285\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:25105\r\n\r\n{\"model",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 285\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:25105\r\n\r\n{\"model",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ccb76c67a8e54c075c46871fd765adca911864f7",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 25105,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:25105 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"target_port_label": "25105 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 25105,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 25105,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:25105 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "25105 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "25105"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.68,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_llm_api_scrape",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:35 UTC
TCP
1207 · HTTP
Scan de ports
port scan syn · via HTTP:1207 · (reconnaissance) · → /anthropic/v1/messages
Élevée
Moyen · 63
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_jwt_body
Cible HTTP
POST
/anthropic/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
1207
Chemin / cible
/anthropic/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /anthropic/v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: clo
Requête brute (extrait)
POST /anthropic/v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 199 Accept-Encoding: gzip, compress, deflate, br
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "f3dc7b1e8742ef425fa4df89199a472507074d2f",
"http_target_hash": "4c3e5d0e0a234b619263ba3580eef2a7e5434387",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 480,
"payload_entropy": 5.2221869577029665,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 1207,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "3f85dd7755366d8fac301bb39d7264f83e5bd8b0",
"event_fingerprint": "9bf43232971463bac1c0afc0649b940db12edffa",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "8f2e1cb379f7363c20305ca287b850b7",
"path_pattern_hash": "59a96edfcfb020a16f97294a554c1ccd"
},
"target_context": {
"dst_port": 1207,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"evidence": {
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aa5d17b5ac7561f3a0ce885f945030c793922eb1",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 1207,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"attack_vector": "port scan syn \u00b7 via HTTP:1207 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"target_port_label": "1207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1207,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 1207,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:1207 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"target_port_label": "1207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1207"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.67,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_jwt_body",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:32 UTC
TCP
177 · HTTP
Scan de ports
port scan syn · via HTTP:177 · (reconnaissance) · → /anthropic/messages
Élevée
Moyen · 50
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/messages UA axios/1.18.1
Émulateur
HTTP
WAF
12
Recommandation
Investiguer
Tags
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
177
Chemin / cible
/anthropic/messages
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
nosqli-3
Payload (extrait)
POST /anthropic/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /anthropic/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 175 Accept-Encoding: gzip, compress, deflate, br Hos
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "35def72dfb9b076fe79dbd3d4776154e9fb9664d",
"http_target_hash": "43e7caacf9ef14cae77115b86fe870c4267ea7ba",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 452,
"payload_entropy": 5.195437175147961,
"port_category": "well_known",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 177,
"risk_waf": 56,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 50,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d1e1057aee059ac1198edcfffa76fff1f4c183a9",
"event_fingerprint": "92537f15d5fe56d0151628da00cab5ee4b8b6c84",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 50,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "6e3e6cd4aeabe79fa3f61fae0c303840",
"path_pattern_hash": "134c8c19df8466a0488f4d696bc0689f"
},
"target_context": {
"dst_port": 177,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r",
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 175\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 175\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d150a2aea8b515db0bc1b8870420855c200f17aa",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 177,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:177 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"target_port_label": "177 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 50,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 177,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 177,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:177 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "177 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 56 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "177"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.43,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:32 UTC
TCP
9595 · HTTP
Scan de ports
port scan syn · via HTTP:9595 · (reconnaissance) · → /v1/messages
Élevée
Moyen · 60
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9595
Chemin / cible
/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
anthro
Requête brute (extrait)
POST /v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 172 Accept-Encoding: gzip, compress, deflate, br Host: 62.3
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "b57fc7370a8982e7e128ad5ab98a7de5ce0ef67d",
"http_target_hash": "db019ad17e38ba897d71591e9e52878ec973496c",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 443,
"payload_entropy": 5.21993717041534,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 9595,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 60,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "fbba59b3b8bee14315bdc48d24796437c5359238",
"event_fingerprint": "a782afdc90e3b4658955acd3b5cb0e634ba47e28",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 60,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "af3b5eed8be788fbeb84eee442225030",
"path_pattern_hash": "c64fb925aa64878f95c3f56184f77f2c"
},
"target_context": {
"dst_port": 9595,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 172\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"evidence": {
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 172\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8da5ff9a3f0f8eb6c24f529063e9790c92845025",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 9595,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"attack_vector": "port scan syn \u00b7 via HTTP:9595 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"target_port_label": "9595 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 60,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9595,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 9595,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9595 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"target_port_label": "9595 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9595"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.42,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:32 UTC
TCP
2250 · HTTP
Scan de ports
port scan syn · via HTTP:2250 · (reconnaissance) · → /v1/chat/completions
Élevée
Élevé · 71
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/chat/completions UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_llm_api_scrape
Cible HTTP
POST
/v1/chat/completions
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2250
Chemin / cible
/v1/chat/completions
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 71
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/chat/completions HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/chat/completions HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /v1/chat/completions HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close User-Agent: axios/1.18.1 Content-Length: 273 Accept-Encoding: gzip, compress, deflate, br Host: 62.3.50.33:2250 {"model"
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "03b00cf58928fc47b2ea2c23bb46c8c88762ef4e",
"http_target_hash": "677ecf6c8ea5590ca72079d2c8422b224d690b39",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 521,
"payload_entropy": 5.1560573260755485,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 2250,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "548b56763f78bcf5b487b3c377059e03535b1834",
"event_fingerprint": "79c4476b1a1579bd13bf51b041d0b59c1a6f9e46",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "fff95676533ed80c3d7e7e610c04ee16",
"path_pattern_hash": "2e3b96fc129d494b171c50c85551ee22"
},
"target_context": {
"dst_port": 2250,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 273\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:2250\r\n\r\n{\"model\"",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 273\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:2250\r\n\r\n{\"model\"",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f3f59dc190bd93accf27b17663752bb80c671418",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 2250,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:2250 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"target_port_label": "2250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2250,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 2250,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:2250 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "2250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2250"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.41,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_llm_api_scrape",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:32 UTC
TCP
480 · HTTP
Scan de ports
port scan syn · via HTTP:480 · (reconnaissance) · → /v1/chat/completions
Élevée
Élevé · 71
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/chat/completions UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_jwt_body
Cible HTTP
POST
/v1/chat/completions
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
480
Chemin / cible
/v1/chat/completions
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 71
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/chat/completions HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/chat/completions HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /v1/chat/completions HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close User-Agent: axios/1.18.1 Content-Length: 292 Accept-Encoding: gzip, compress, deflate, br Host: 62.3.50.33:480 {"model":
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "6b0c3d7d19976f022627aac29a5745e9dbed4d46",
"http_target_hash": "677ecf6c8ea5590ca72079d2c8422b224d690b39",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 539,
"payload_entropy": 5.179727686874743,
"port_category": "well_known",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 480,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "50c66f4044417ab2d43c3f86449683f3b1b7b1b0",
"event_fingerprint": "3c12ecfa79d0dba0d01b0ab615d08929a81d4c13",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "698f9745058e785031bc3de7ac946448",
"path_pattern_hash": "2e3b96fc129d494b171c50c85551ee22"
},
"target_context": {
"dst_port": 480,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 292\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:480\r\n\r\n{\"model\":",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 292\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:480\r\n\r\n{\"model\":",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f07e0a743cb4fc20776af3969f0da1a72ed54ffd",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 480,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:480 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"target_port_label": "480 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 480,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 480,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:480 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "480 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "480"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.41,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_jwt_body",
"http_llm_api_scrape",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:32 UTC
TCP
3500 · HTTP
Scan de ports
port scan syn · via HTTP:3500 · (reconnaissance) · → /v1/chat/completions
Élevée
Élevé · 73
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/chat/completions UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_llm_api_scrape
Cible HTTP
POST
/v1/chat/completions
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3500
Chemin / cible
/v1/chat/completions
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 73
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/chat/completions HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/chat/completions HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /v1/chat/completions HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close User-Agent: axios/1.18.1 Content-Length: 262 Accept-Encoding: gzip, compress, deflate, br Host: 62.3.50.33:3500 {"model"
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "8e9e5fcc91a795f8d10bb7233e483121ca7c7a63",
"http_target_hash": "677ecf6c8ea5590ca72079d2c8422b224d690b39",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 510,
"payload_entropy": 5.139129494817314,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 3500,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "c6329ec7412fc6e0b6345841acbe85b392fd6343",
"event_fingerprint": "9a667e29c06c281aac78e976b542ccfa5abe9566",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "6ad044398b700545ec1a865a96be7a18",
"path_pattern_hash": "2e3b96fc129d494b171c50c85551ee22"
},
"target_context": {
"dst_port": 3500,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 262\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:3500\r\n\r\n{\"model\"",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 262\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:3500\r\n\r\n{\"model\"",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5f49ccf8c410fd15aa0701782144cc56900d09eb",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 3500,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:3500 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"target_port_label": "3500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3500,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 3500,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3500 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "3500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3500"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.4,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_llm_api_scrape",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:32 UTC
TCP
25105 · HTTP
Scan de ports
port scan syn · via HTTP:25105 · (reconnaissance) · → /anthropic/messages
Élevée
Moyen · 51
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/messages UA axios/1.18.1
Émulateur
HTTP
WAF
12
Recommandation
Investiguer
Tags
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
25105
Chemin / cible
/anthropic/messages
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 51
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
nosqli-3
Payload (extrait)
POST /anthropic/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /anthropic/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 180 Accept-Encoding: gzip, compress, deflate, br Hos
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "db07f5a8a719154561900d2785dd5f880892c23b",
"http_target_hash": "43e7caacf9ef14cae77115b86fe870c4267ea7ba",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 459,
"payload_entropy": 5.219427990615236,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 25105,
"risk_waf": 56,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 51,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2fb83cf91f7f68640ded56bfc9de06e448d4eeeb",
"event_fingerprint": "233078951b35e8195d7b7f396b9fd9affdabbe78",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "1be649dbffd9763af7b1b2183ebc02a3",
"path_pattern_hash": "134c8c19df8466a0488f4d696bc0689f"
},
"target_context": {
"dst_port": 25105,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r",
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "352ca2af51b7a6b69f268a58da02081dd9aecd50",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 25105,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:25105 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"target_port_label": "25105 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 25105,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 25105,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:25105 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "25105 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 56 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "25105"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.39,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:32 UTC
TCP
10020 · HTTP
Scan de ports
port scan syn · via HTTP:10020 · (reconnaissance) · → /anthropic/messages
Élevée
Moyen · 48
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/messages UA axios/1.18.1
Émulateur
HTTP
WAF
12
Recommandation
Surveiller
Tags
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
10020
Chemin / cible
/anthropic/messages
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 48
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
nosqli-3
Payload (extrait)
POST /anthropic/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /anthropic/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 181 Accept-Encoding: gzip, compress, deflate, br Hos
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "d1a9810965e38e25dee856166934b89304e50f24",
"http_target_hash": "43e7caacf9ef14cae77115b86fe870c4267ea7ba",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 460,
"payload_entropy": 5.167922487355582,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 10020,
"risk_waf": 56,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 48,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "6bcb1dd5c97c396cffb17b7f773eb3e21e3bdf6b",
"event_fingerprint": "ba5a2a41a1c3a311c36545f7aa50d620dc912a0f",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "3681ba6bdc720487ea8b637924a84097",
"path_pattern_hash": "134c8c19df8466a0488f4d696bc0689f"
},
"target_context": {
"dst_port": 10020,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r",
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 181\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 181\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a2e8fb9a0122c791afd8c4be40d1e7be71161bbe",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 10020,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:10020 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"target_port_label": "10020 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10020,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 10020,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:10020 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "10020 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 56 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.39,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:32 UTC
TCP
1207 · HTTP
Scan de ports
port scan syn · via HTTP:1207 · (reconnaissance) · → /v1/messages
Élevée
Moyen · 63
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_jwt_body
Cible HTTP
POST
/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
1207
Chemin / cible
/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
anthro
Requête brute (extrait)
POST /v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 199 Accept-Encoding: gzip, compress, deflate, br Host: 62.3
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "f3dc7b1e8742ef425fa4df89199a472507074d2f",
"http_target_hash": "db019ad17e38ba897d71591e9e52878ec973496c",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 470,
"payload_entropy": 5.227779977415789,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 1207,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "3f85dd7755366d8fac301bb39d7264f83e5bd8b0",
"event_fingerprint": "dcf775a155ccece29ef651c2247bf519683523e3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "9ef8b576da5649709f13a2562baa46bf",
"path_pattern_hash": "c64fb925aa64878f95c3f56184f77f2c"
},
"target_context": {
"dst_port": 1207,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"evidence": {
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "43626982e55c3a27615150bc86d48a455da78db4",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 1207,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"attack_vector": "port scan syn \u00b7 via HTTP:1207 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"target_port_label": "1207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1207,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 1207,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:1207 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"target_port_label": "1207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1207"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.38,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_jwt_body",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:30 UTC
TCP
3500 · HTTP
Scan de ports
port scan syn · via HTTP:3500 · (reconnaissance) · → /anthropic/messages
Élevée
Moyen · 51
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/messages UA axios/1.18.1
Émulateur
HTTP
WAF
12
Recommandation
Investiguer
Tags
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3500
Chemin / cible
/anthropic/messages
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 51
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
nosqli-3
Payload (extrait)
POST /anthropic/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /anthropic/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 180 Accept-Encoding: gzip, compress, deflate, br Hos
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "8e9e5fcc91a795f8d10bb7233e483121ca7c7a63",
"http_target_hash": "43e7caacf9ef14cae77115b86fe870c4267ea7ba",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 458,
"payload_entropy": 5.199674384526581,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 3500,
"risk_waf": 56,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 51,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "48512048cdcf9323a69a19efac24cb4e58d42e0c",
"event_fingerprint": "618dee7f9b009f05f719ed61a221257c2b9d5f22",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "1be649dbffd9763af7b1b2183ebc02a3",
"path_pattern_hash": "134c8c19df8466a0488f4d696bc0689f"
},
"target_context": {
"dst_port": 3500,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r",
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "db20d6eac1d7c368c20d976145b10ce6c3345ad2",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 3500,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:3500 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"target_port_label": "3500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3500,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 3500,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3500 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "3500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 56 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3500"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.63,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:30 UTC
TCP
25105 · HTTP
Scan de ports
port scan syn · via HTTP:25105 · (reconnaissance) · → /anthropic/v1/messages
Élevée
Moyen · 62
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
25105
Chemin / cible
/anthropic/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /anthropic/v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: clo
Requête brute (extrait)
POST /anthropic/v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 180 Accept-Encoding: gzip, compress, deflate, br
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "db07f5a8a719154561900d2785dd5f880892c23b",
"http_target_hash": "4c3e5d0e0a234b619263ba3580eef2a7e5434387",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 462,
"payload_entropy": 5.226434044910467,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 25105,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f9fc996b0dfe83628d0895436002550f8b61c7b1",
"event_fingerprint": "8055f65c1f4f7d199cf8406b68f95c7c5b1ab495",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "ddd3f0508412cd4ea9f928e782f2d3f5",
"path_pattern_hash": "59a96edfcfb020a16f97294a554c1ccd"
},
"target_context": {
"dst_port": 25105,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"evidence": {
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a6f393003405a13f864bfbf39e3c91337a15cdd5",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 25105,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"attack_vector": "port scan syn \u00b7 via HTTP:25105 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"target_port_label": "25105 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 25105,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 25105,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:25105 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"target_port_label": "25105 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "25105"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.63,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:30 UTC
TCP
2250 · HTTP
Scan de ports
port scan syn · via HTTP:2250 · (reconnaissance) · → /anthropic/messages
Élevée
Moyen · 61
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950319:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2250
Chemin / cible
/anthropic/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /anthropic/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /anthropic/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 176 Accept-Encoding: gzip, compress, deflate, br Hos
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "03b00cf58928fc47b2ea2c23bb46c8c88762ef4e",
"http_target_hash": "43e7caacf9ef14cae77115b86fe870c4267ea7ba",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 454,
"payload_entropy": 5.209024166129413,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 2250,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 61,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4274466d0a6d6b468e30f4ce8411ea89d4ba542d",
"event_fingerprint": "a24ac2f7a22af4f79d30cd353f8704ac3cfe604d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 61,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "b0d9b35961b6dd5ff2b504f29954682d",
"path_pattern_hash": "134c8c19df8466a0488f4d696bc0689f"
},
"target_context": {
"dst_port": 2250,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r",
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950319:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 176\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950319:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 176\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a0b1dcc8e2768f1c1eb397925984b495059e543c",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 2250,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:2250 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"target_port_label": "2250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 61,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2250,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 2250,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:2250 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "2250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2250"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.63,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:30 UTC
TCP
480 · HTTP
Scan de ports
port scan syn · via HTTP:480 · (reconnaissance) · → /anthropic/messages
Élevée
Moyen · 50
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/messages UA axios/1.18.1
Émulateur
HTTP
WAF
12
Recommandation
Investiguer
Tags
950468:nosqli-3
950470:nosqli-3
http_jwt_body
http_mass_assignment
Cible HTTP
POST
/anthropic/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
480
Chemin / cible
/anthropic/messages
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
nosqli-3
Payload (extrait)
POST /anthropic/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /anthropic/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 185 Accept-Encoding: gzip, compress, deflate, br Hos
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "6b0c3d7d19976f022627aac29a5745e9dbed4d46",
"http_target_hash": "43e7caacf9ef14cae77115b86fe870c4267ea7ba",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 462,
"payload_entropy": 5.179408255679277,
"port_category": "well_known",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 480,
"risk_waf": 56,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 50,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e43fc959ae7ca0a0264a400606a7a878e136999b",
"event_fingerprint": "e1bcfc40a9aad6632a063cf5247ecde23aaa5731",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 50,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "21850b0505bcb6a773e42a3ae0938662",
"path_pattern_hash": "134c8c19df8466a0488f4d696bc0689f"
},
"target_context": {
"dst_port": 480,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r",
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 185\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 185\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aae07b52abf96beedd38ea0ac87bb879fdab5f23",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 480,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:480 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"target_port_label": "480 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 50,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 480,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 480,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:480 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "480 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 56 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "480"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.62,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"http_jwt_body",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:30 UTC
TCP
9595 · HTTP
Scan de ports
port scan syn · via HTTP:9595 · (reconnaissance) · → /v1/chat/completions
Élevée
Élevé · 71
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/chat/completions UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_llm_api_scrape
Cible HTTP
POST
/v1/chat/completions
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9595
Chemin / cible
/v1/chat/completions
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 71
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/chat/completions HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/chat/completions HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /v1/chat/completions HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close User-Agent: axios/1.18.1 Content-Length: 265 Accept-Encoding: gzip, compress, deflate, br Host: 62.3.50.33:9595 {"model"
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "b57fc7370a8982e7e128ad5ab98a7de5ce0ef67d",
"http_target_hash": "677ecf6c8ea5590ca72079d2c8422b224d690b39",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 513,
"payload_entropy": 5.1565034358299355,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 9595,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "86a0ccebfef142d246e361dcb4d0d39c8d136967",
"event_fingerprint": "f1a74d238c4ae292930eb9f8c1402e18b40bbcc0",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "d07398be6c18d100baa21f0369220a34",
"path_pattern_hash": "2e3b96fc129d494b171c50c85551ee22"
},
"target_context": {
"dst_port": 9595,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 265\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:9595\r\n\r\n{\"model\"",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 265\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:9595\r\n\r\n{\"model\"",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e693b17e1f375d65515acd3b49f9b7c1578b397c",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 9595,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:9595 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"target_port_label": "9595 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9595,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 9595,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9595 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "9595 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9595"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.62,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_llm_api_scrape",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:30 UTC
TCP
1207 · HTTP
Scan de ports
port scan syn · via HTTP:1207 · (reconnaissance) · → /v1/chat/completions
Élevée
Élevé · 73
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/chat/completions UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_jwt_body
Cible HTTP
POST
/v1/chat/completions
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
1207
Chemin / cible
/v1/chat/completions
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 73
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/chat/completions HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/chat/completions HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /v1/chat/completions HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close User-Agent: axios/1.18.1 Content-Length: 292 Accept-Encoding: gzip, compress, deflate, br Host: 62.3.50.33:1207 {"model"
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "f3dc7b1e8742ef425fa4df89199a472507074d2f",
"http_target_hash": "677ecf6c8ea5590ca72079d2c8422b224d690b39",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 540,
"payload_entropy": 5.179967570634429,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 1207,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "927bf54ce2b24582a4807ab9cbc79db06ee724e3",
"event_fingerprint": "e5da9e9abf0307091f9786b7264183f3f07571e8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "f3dff8233f29684e7014db4f33e0ce09",
"path_pattern_hash": "2e3b96fc129d494b171c50c85551ee22"
},
"target_context": {
"dst_port": 1207,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 292\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:1207\r\n\r\n{\"model\"",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 292\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:1207\r\n\r\n{\"model\"",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d1e41499d930284cf6d68e261fb90b6a58ca3601",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 1207,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:1207 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"target_port_label": "1207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1207,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 1207,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:1207 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "1207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1207"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.62,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_jwt_body",
"http_llm_api_scrape",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:30 UTC
TCP
177 · HTTP
Scan de ports
port scan syn · via HTTP:177 · (reconnaissance) · → /anthropic/v1/messages
Élevée
Moyen · 61
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
177
Chemin / cible
/anthropic/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /anthropic/v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: clo
Requête brute (extrait)
POST /anthropic/v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 175 Accept-Encoding: gzip, compress, deflate, br
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "35def72dfb9b076fe79dbd3d4776154e9fb9664d",
"http_target_hash": "4c3e5d0e0a234b619263ba3580eef2a7e5434387",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 455,
"payload_entropy": 5.202563490479855,
"port_category": "well_known",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 177,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 61,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "77d7fcde43c4da8b6fac80375e0a1cfca0cfd176",
"event_fingerprint": "a35fa159e7e704b05d5df686232a97666cf0edf2",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 61,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "1d406d1498fa05128c6db6b94077c79a",
"path_pattern_hash": "59a96edfcfb020a16f97294a554c1ccd"
},
"target_context": {
"dst_port": 177,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 175\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"evidence": {
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 175\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6304102bb3ef3df8ad825da65aff261766aa53b6",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 177,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"attack_vector": "port scan syn \u00b7 via HTTP:177 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"target_port_label": "177 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 61,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 177,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 177,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:177 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"target_port_label": "177 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "177"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:30 UTC
TCP
10020 · HTTP
Scan de ports
port scan syn · via HTTP:10020 · (reconnaissance) · → /anthropic/v1/messages
Élevée
Moyen · 59
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
10020
Chemin / cible
/anthropic/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /anthropic/v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: clo
Requête brute (extrait)
POST /anthropic/v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 181 Accept-Encoding: gzip, compress, deflate, br
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "d1a9810965e38e25dee856166934b89304e50f24",
"http_target_hash": "4c3e5d0e0a234b619263ba3580eef2a7e5434387",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 463,
"payload_entropy": 5.174608362644602,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 10020,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 59,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d8e9976d6b68c8b6f3af5c87e975d2986b4ada6e",
"event_fingerprint": "3525db05061e7e926fc6bbf30299fa5d7b811534",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 59,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "086bfce5f5d8dcfea36386e22751b23c",
"path_pattern_hash": "59a96edfcfb020a16f97294a554c1ccd"
},
"target_context": {
"dst_port": 10020,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 181\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"evidence": {
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 181\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f0c27d8d82774d370673b716f39b16b7e1fdca5",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 10020,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"attack_vector": "port scan syn \u00b7 via HTTP:10020 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"target_port_label": "10020 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 59,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10020,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 10020,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:10020 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"target_port_label": "10020 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:27 UTC
TCP
177 · HTTP
Scan de ports
port scan syn · via HTTP:177 · (reconnaissance) · → /v1/messages
Élevée
Moyen · 61
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
177
Chemin / cible
/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
anthro
Requête brute (extrait)
POST /v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 175 Accept-Encoding: gzip, compress, deflate, br Host: 62.3
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "35def72dfb9b076fe79dbd3d4776154e9fb9664d",
"http_target_hash": "db019ad17e38ba897d71591e9e52878ec973496c",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 445,
"payload_entropy": 5.207635900018016,
"port_category": "well_known",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 177,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 61,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "77d7fcde43c4da8b6fac80375e0a1cfca0cfd176",
"event_fingerprint": "06f94e241bd6f164ae64bb376718432deb6d51e1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 61,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "585a5cf50a4cac24e1e7ea90a2b2849a",
"path_pattern_hash": "c64fb925aa64878f95c3f56184f77f2c"
},
"target_context": {
"dst_port": 177,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 175\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"evidence": {
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 175\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "345cf32519e1428c5c1e1b0b337107d1d0d9a010",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 177,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"attack_vector": "port scan syn \u00b7 via HTTP:177 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"target_port_label": "177 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 61,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 177,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 177,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:177 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"target_port_label": "177 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "177"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.97,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:27 UTC
TCP
1207 · HTTP
Scan de ports
port scan syn · via HTTP:1207 · (reconnaissance) · → /anthropic/messages
Élevée
Moyen · 52
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/messages UA axios/1.18.1
Émulateur
HTTP
WAF
12
Recommandation
Investiguer
Tags
950468:nosqli-3
950470:nosqli-3
http_jwt_body
http_mass_assignment
Cible HTTP
POST
/anthropic/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
1207
Chemin / cible
/anthropic/messages
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 52
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
nosqli-3
Payload (extrait)
POST /anthropic/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /anthropic/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 199 Accept-Encoding: gzip, compress, deflate, br Hos
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "f3dc7b1e8742ef425fa4df89199a472507074d2f",
"http_target_hash": "43e7caacf9ef14cae77115b86fe870c4267ea7ba",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 477,
"payload_entropy": 5.225839852270162,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 1207,
"risk_waf": 56,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "0eb945a093ff70ff185082481f64610d1cad4313",
"event_fingerprint": "02e029f5211e7c8a50e7c120565f1873079d9617",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "999813c147cf17aae89d00fc12551ec6",
"path_pattern_hash": "134c8c19df8466a0488f4d696bc0689f"
},
"target_context": {
"dst_port": 1207,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r",
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9d82555421b5cb2a24edad77d8424f0d52a28d18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 1207,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:1207 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"target_port_label": "1207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1207,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 1207,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:1207 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "1207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 56 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1207"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.96,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"http_jwt_body",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:27 UTC
TCP
9595 · HTTP
Scan de ports
port scan syn · via HTTP:9595 · (reconnaissance) · → /anthropic/messages
Élevée
Moyen · 49
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/messages UA axios/1.18.1
Émulateur
HTTP
WAF
12
Recommandation
Surveiller
Tags
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9595
Chemin / cible
/anthropic/messages
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 49
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
nosqli-3
Payload (extrait)
POST /anthropic/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /anthropic/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 172 Accept-Encoding: gzip, compress, deflate, br Hos
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "b57fc7370a8982e7e128ad5ab98a7de5ce0ef67d",
"http_target_hash": "43e7caacf9ef14cae77115b86fe870c4267ea7ba",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 450,
"payload_entropy": 5.207035616979983,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 9595,
"risk_waf": 56,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 49,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "3b65ec125f87086420dcc7d31227d03f3fae84d1",
"event_fingerprint": "fe22589376d9f9c099e3477bb87b5f832addd074",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 49,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "5b218996d93266017d1f1e71181bfaba",
"path_pattern_hash": "134c8c19df8466a0488f4d696bc0689f"
},
"target_context": {
"dst_port": 9595,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r",
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 172\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 172\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a0506414aeb1ba34ce294c4b190a8c0cb8eef1b2",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 9595,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:9595 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"target_port_label": "9595 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 49,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9595,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 9595,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9595 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "9595 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 56 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9595"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.95,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:27 UTC
TCP
10020 · HTTP
Scan de ports
port scan syn · via HTTP:10020 · (reconnaissance) · → /v1/messages
Élevée
Moyen · 59
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
10020
Chemin / cible
/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 59
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
anthro
Requête brute (extrait)
POST /v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 181 Accept-Encoding: gzip, compress, deflate, br Host: 62.3
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "d1a9810965e38e25dee856166934b89304e50f24",
"http_target_hash": "db019ad17e38ba897d71591e9e52878ec973496c",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 453,
"payload_entropy": 5.179254628314182,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 10020,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 59,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d8e9976d6b68c8b6f3af5c87e975d2986b4ada6e",
"event_fingerprint": "b57381860c9c83dad6ed444a806123a8350cc3d1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 59,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "da5764f8cd4823a42f7073d7be4863bc",
"path_pattern_hash": "c64fb925aa64878f95c3f56184f77f2c"
},
"target_context": {
"dst_port": 10020,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 181\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"evidence": {
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 181\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "73a61383142980d97413f4f9bd74a4a0277b34ac",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 10020,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"attack_vector": "port scan syn \u00b7 via HTTP:10020 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"target_port_label": "10020 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 59,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10020,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 10020,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:10020 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"target_port_label": "10020 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.94,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:27 UTC
TCP
2250 · HTTP
Scan de ports
port scan syn · via HTTP:2250 · (reconnaissance) · → /anthropic/v1/messages
Élevée
Élevé · 65
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950316:lfi-14
950319:lfi-14
950468:nosqli-3
950470:nosqli-3
Cible HTTP
POST
/anthropic/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2250
Chemin / cible
/anthropic/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /anthropic/v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: clo
Requête brute (extrait)
POST /anthropic/v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 176 Accept-Encoding: gzip, compress, deflate, br
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "03b00cf58928fc47b2ea2c23bb46c8c88762ef4e",
"http_target_hash": "4c3e5d0e0a234b619263ba3580eef2a7e5434387",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 457,
"payload_entropy": 5.216467421160967,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 2250,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 65,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "bc49480d09114aa13efd5ff16e4088da41dfba63",
"event_fingerprint": "a7bec42d5292aa7186fd1a8edbd24d8df5747e95",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "4c82fc9ab2501093c2c61dc26c72e2c0",
"path_pattern_hash": "59a96edfcfb020a16f97294a554c1ccd"
},
"target_context": {
"dst_port": 2250,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950319:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 176\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"evidence": {
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950319:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 176\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d120006df4fd453d3d91bdd18a5930031f435807",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 2250,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"attack_vector": "port scan syn \u00b7 via HTTP:2250 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"target_port_label": "2250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2250,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 2250,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:2250 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"target_port_label": "2250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2250"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.93,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950319:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:27 UTC
TCP
480 · HTTP
Scan de ports
port scan syn · via HTTP:480 · (reconnaissance) · → /anthropic/v1/messages
Élevée
Moyen · 61
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_jwt_body
Cible HTTP
POST
/anthropic/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
480
Chemin / cible
/anthropic/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /anthropic/v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: clo
Requête brute (extrait)
POST /anthropic/v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 185 Accept-Encoding: gzip, compress, deflate, br
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "6b0c3d7d19976f022627aac29a5745e9dbed4d46",
"http_target_hash": "4c3e5d0e0a234b619263ba3580eef2a7e5434387",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 465,
"payload_entropy": 5.187422021971449,
"port_category": "well_known",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 480,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f0056c109ad21c6cd44efe2830482f446f331203",
"event_fingerprint": "956eba05aa838e4982f64bad88b5eea06c189eb3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "dda6e483518fd18d088f17bf3a9e5aea",
"path_pattern_hash": "59a96edfcfb020a16f97294a554c1ccd"
},
"target_context": {
"dst_port": 480,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 185\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"evidence": {
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 185\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3153867df7159594dd55fd78c29fa74bf65142c2",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 480,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"attack_vector": "port scan syn \u00b7 via HTTP:480 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"target_port_label": "480 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 480,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 480,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:480 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"target_port_label": "480 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "480"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.92,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_jwt_body",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:27 UTC
TCP
3500 · HTTP
Scan de ports
port scan syn · via HTTP:3500 · (reconnaissance) · → /anthropic/v1/messages
Élevée
Moyen · 62
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3500
Chemin / cible
/anthropic/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /anthropic/v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: clo
Requête brute (extrait)
POST /anthropic/v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 180 Accept-Encoding: gzip, compress, deflate, br
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "8e9e5fcc91a795f8d10bb7233e483121ca7c7a63",
"http_target_hash": "4c3e5d0e0a234b619263ba3580eef2a7e5434387",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 461,
"payload_entropy": 5.206803774949374,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 3500,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a75a89f7c72cb5321f9867538a6531828c0b3f96",
"event_fingerprint": "34462e5f645e1d55a0c695f2341c8f31f6b3cde1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "ddd3f0508412cd4ea9f928e782f2d3f5",
"path_pattern_hash": "59a96edfcfb020a16f97294a554c1ccd"
},
"target_context": {
"dst_port": 3500,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"evidence": {
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7e8ac1a5da3ecd2f12e8b37218575f3636a48de6",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 3500,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"attack_vector": "port scan syn \u00b7 via HTTP:3500 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"target_port_label": "3500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3500,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 3500,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3500 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"target_port_label": "3500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3500"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.91,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:27 UTC
TCP
25105 · HTTP
Scan de ports
port scan syn · via HTTP:25105 · (reconnaissance) · → /v1/messages
Élevée
Moyen · 62
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
25105
Chemin / cible
/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
anthro
Requête brute (extrait)
POST /v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 180 Accept-Encoding: gzip, compress, deflate, br Host: 62.3
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "db07f5a8a719154561900d2785dd5f880892c23b",
"http_target_hash": "db019ad17e38ba897d71591e9e52878ec973496c",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 452,
"payload_entropy": 5.232099475255557,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 25105,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f9fc996b0dfe83628d0895436002550f8b61c7b1",
"event_fingerprint": "89ac1029435c2a613df68b40164ba93deb00abce",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "d5392a6e5363e60187b03a604e915664",
"path_pattern_hash": "c64fb925aa64878f95c3f56184f77f2c"
},
"target_context": {
"dst_port": 25105,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"evidence": {
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "269bb6d1f710a9892586c1a87f417b0b60581019",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 25105,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"attack_vector": "port scan syn \u00b7 via HTTP:25105 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"target_port_label": "25105 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 25105,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 25105,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:25105 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"target_port_label": "25105 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "25105"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.9,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:24 UTC
TCP
1207 · HTTP
Scan de ports
port scan syn · via HTTP:1207 · (reconnaissance) · → /anthropic/v1/messages
Élevée
Moyen · 63
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_jwt_body
Cible HTTP
POST
/anthropic/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
1207
Chemin / cible
/anthropic/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /anthropic/v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: clo
Requête brute (extrait)
POST /anthropic/v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 199 Accept-Encoding: gzip, compress, deflate, br
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "f3dc7b1e8742ef425fa4df89199a472507074d2f",
"http_target_hash": "4c3e5d0e0a234b619263ba3580eef2a7e5434387",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 480,
"payload_entropy": 5.231292860824724,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 1207,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "3f85dd7755366d8fac301bb39d7264f83e5bd8b0",
"event_fingerprint": "9bf43232971463bac1c0afc0649b940db12edffa",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "8f2e1cb379f7363c20305ca287b850b7",
"path_pattern_hash": "59a96edfcfb020a16f97294a554c1ccd"
},
"target_context": {
"dst_port": 1207,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"evidence": {
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aa5d17b5ac7561f3a0ce885f945030c793922eb1",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 1207,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"attack_vector": "port scan syn \u00b7 via HTTP:1207 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"target_port_label": "1207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1207,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 1207,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:1207 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"target_port_label": "1207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1207"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.86,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_jwt_body",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:24 UTC
TCP
480 · HTTP
Scan de ports
port scan syn · via HTTP:480 · (reconnaissance) · → /v1/messages
Élevée
Moyen · 61
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_jwt_body
Cible HTTP
POST
/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
480
Chemin / cible
/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
anthro
Requête brute (extrait)
POST /v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 185 Accept-Encoding: gzip, compress, deflate, br Host: 62.3
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "6b0c3d7d19976f022627aac29a5745e9dbed4d46",
"http_target_hash": "db019ad17e38ba897d71591e9e52878ec973496c",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 455,
"payload_entropy": 5.193452844148488,
"port_category": "well_known",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 480,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f0056c109ad21c6cd44efe2830482f446f331203",
"event_fingerprint": "a90318b96d425163c5b43132a86102dd8ed2af01",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "1a39a9ee96b20ae2f937e081d844de89",
"path_pattern_hash": "c64fb925aa64878f95c3f56184f77f2c"
},
"target_context": {
"dst_port": 480,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 185\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"evidence": {
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 185\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f877b26214d8925c803fb7c8daf17cf8172c35ab",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 480,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"attack_vector": "port scan syn \u00b7 via HTTP:480 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"target_port_label": "480 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 480,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 480,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:480 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"target_port_label": "480 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "480"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.85,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_jwt_body",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:24 UTC
TCP
9595 · HTTP
Scan de ports
port scan syn · via HTTP:9595 · (reconnaissance) · → /anthropic/v1/messages
Élevée
Moyen · 60
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9595
Chemin / cible
/anthropic/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /anthropic/v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: clo
Requête brute (extrait)
POST /anthropic/v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 172 Accept-Encoding: gzip, compress, deflate, br
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "b57fc7370a8982e7e128ad5ab98a7de5ce0ef67d",
"http_target_hash": "4c3e5d0e0a234b619263ba3580eef2a7e5434387",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 453,
"payload_entropy": 5.2144289487994415,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 9595,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 60,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "fbba59b3b8bee14315bdc48d24796437c5359238",
"event_fingerprint": "b5898d135d843f01da5e351ba3badd4089cf7ab7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 60,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "a6f7afa54acbec3901a2d3c4e383c9fb",
"path_pattern_hash": "59a96edfcfb020a16f97294a554c1ccd"
},
"target_context": {
"dst_port": 9595,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 172\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"evidence": {
"method": "POST",
"path": "\/anthropic\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 172\r\nAccept-Encoding: gzip, compress, deflate, br\r\n",
"payload_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31307bbba437d3ab67d7203c4fb724a8296fd1b0",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 9595,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"attack_vector": "port scan syn \u00b7 via HTTP:9595 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"target_port_label": "9595 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 60,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9595,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/v1\/messages",
"request_line": "POST \/anthropic\/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 9595,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9595 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/v1\/messages",
"evidence_snippet": "POST \/anthropic\/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: clo",
"target_port_label": "9595 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9595"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.84,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:24 UTC
TCP
25105 · HTTP
Scan de ports
port scan syn · via HTTP:25105 · (reconnaissance) · → /v1/chat/completions
Élevée
Élevé · 73
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/chat/completions UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_llm_api_scrape
Cible HTTP
POST
/v1/chat/completions
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
25105
Chemin / cible
/v1/chat/completions
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 73
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/chat/completions HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/chat/completions HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /v1/chat/completions HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close User-Agent: axios/1.18.1 Content-Length: 273 Accept-Encoding: gzip, compress, deflate, br Host: 62.3.50.33:25105 {"model
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "db07f5a8a719154561900d2785dd5f880892c23b",
"http_target_hash": "677ecf6c8ea5590ca72079d2c8422b224d690b39",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 522,
"payload_entropy": 5.18170708962452,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 25105,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a2f68415c6c39f68c488001b32503be061de7331",
"event_fingerprint": "104cbe4ca4021dd7f1f57c1ea23d1ac56ab76bd6",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "65129fed98e8e3abbe014efce42c7df1",
"path_pattern_hash": "2e3b96fc129d494b171c50c85551ee22"
},
"target_context": {
"dst_port": 25105,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 273\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:25105\r\n\r\n{\"model",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 273\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:25105\r\n\r\n{\"model",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cdf57116864f221020c0b1c8b6c0fa83d124a626",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 25105,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:25105 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"target_port_label": "25105 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 25105,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 25105,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:25105 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "25105 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "25105"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.83,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_llm_api_scrape",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:24 UTC
TCP
10020 · HTTP
Scan de ports
port scan syn · via HTTP:10020 · (reconnaissance) · → /v1/chat/completions
Élevée
Élevé · 69
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/chat/completions UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_llm_api_scrape
Cible HTTP
POST
/v1/chat/completions
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
10020
Chemin / cible
/v1/chat/completions
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/chat/completions HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/chat/completions HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /v1/chat/completions HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close User-Agent: axios/1.18.1 Content-Length: 274 Accept-Encoding: gzip, compress, deflate, br Host: 62.3.50.33:10020 {"model
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "d1a9810965e38e25dee856166934b89304e50f24",
"http_target_hash": "677ecf6c8ea5590ca72079d2c8422b224d690b39",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 523,
"payload_entropy": 5.1352395920444,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 10020,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 69,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "38b1be4222d35dd10b3ab4021f8186ed8924af2b",
"event_fingerprint": "f7d583301b86fbda2f7b01239e8bd69fa4edfa14",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "345a27247e025d2bd3e8b1bab42f9fd2",
"path_pattern_hash": "2e3b96fc129d494b171c50c85551ee22"
},
"target_context": {
"dst_port": 10020,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 274\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:10020\r\n\r\n{\"model",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 274\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:10020\r\n\r\n{\"model",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ed86445ca53251a9e8b493cb7bae8613a0cfa3eb",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 10020,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:10020 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"target_port_label": "10020 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10020,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 10020,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:10020 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "10020 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.66,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_llm_api_scrape",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:24 UTC
TCP
3500 · HTTP
Scan de ports
port scan syn · via HTTP:3500 · (reconnaissance) · → /v1/messages
Élevée
Moyen · 62
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3500
Chemin / cible
/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 62
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
anthro
Requête brute (extrait)
POST /v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 180 Accept-Encoding: gzip, compress, deflate, br Host: 62.3
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "8e9e5fcc91a795f8d10bb7233e483121ca7c7a63",
"http_target_hash": "db019ad17e38ba897d71591e9e52878ec973496c",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 451,
"payload_entropy": 5.212861087745204,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 3500,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 62,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a75a89f7c72cb5321f9867538a6531828c0b3f96",
"event_fingerprint": "d494167b6896c8d3545350b3358f36a49c01a412",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "d5392a6e5363e60187b03a604e915664",
"path_pattern_hash": "c64fb925aa64878f95c3f56184f77f2c"
},
"target_context": {
"dst_port": 3500,
"service": "http",
"service_name": "http",
"risk_score": 62
},
"payload_preview": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"evidence": {
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 180\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f6b8de98d9596c03e49ec9cb286c545004862d1c",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 3500,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"attack_vector": "port scan syn \u00b7 via HTTP:3500 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"target_port_label": "3500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 62,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 62,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3500,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 3500,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3500 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"target_port_label": "3500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3500"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.65,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:24 UTC
TCP
177 · HTTP
Scan de ports
port scan syn · via HTTP:177 · (reconnaissance) · → /v1/chat/completions
Élevée
Élevé · 72
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/chat/completions UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_llm_api_scrape
Cible HTTP
POST
/v1/chat/completions
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
177
Chemin / cible
/v1/chat/completions
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 72
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/chat/completions HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/chat/completions HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /v1/chat/completions HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close User-Agent: axios/1.18.1 Content-Length: 268 Accept-Encoding: gzip, compress, deflate, br Host: 62.3.50.33:177 {"model":
Meta JSON brut
{
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "35def72dfb9b076fe79dbd3d4776154e9fb9664d",
"http_target_hash": "677ecf6c8ea5590ca72079d2c8422b224d690b39",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 515,
"payload_entropy": 5.147488434634011,
"port_category": "well_known",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 177,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b4bd2a2b8cc5e261d8e2b602e26f34e59f158e6",
"event_fingerprint": "5d5ac9e9d1fe19ac3f7d785b22940ad6acc78a40",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "501c21b9cd4a63a39961c65546a3404a",
"path_pattern_hash": "2e3b96fc129d494b171c50c85551ee22"
},
"target_context": {
"dst_port": 177,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 268\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:177\r\n\r\n{\"model\":",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/v1\/chat\/completions",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"request_sample": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 268\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3.50.33:177\r\n\r\n{\"model\":",
"payload_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "33c906c333ad3365b55deb2c68f8e503de0ebaa3",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 177,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:177 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"target_port_label": "177 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 177,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/chat\/completions",
"request_line": "POST \/v1\/chat\/completions HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 177,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:177 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/chat\/completions",
"evidence_snippet": "POST \/v1\/chat\/completions HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "177 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "177"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.64,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_llm_api_scrape",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:24 UTC
TCP
2250 · HTTP
Scan de ports
port scan syn · via HTTP:2250 · (reconnaissance) · → /v1/messages
Élevée
Élevé · 65
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950316:lfi-14
950319:lfi-14
950468:nosqli-3
950470:nosqli-3
Cible HTTP
POST
/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2250
Chemin / cible
/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
anthro
Requête brute (extrait)
POST /v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 176 Accept-Encoding: gzip, compress, deflate, br Host: 62.3
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "03b00cf58928fc47b2ea2c23bb46c8c88762ef4e",
"http_target_hash": "db019ad17e38ba897d71591e9e52878ec973496c",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 447,
"payload_entropy": 5.222956959538807,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 2250,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 65,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "bc49480d09114aa13efd5ff16e4088da41dfba63",
"event_fingerprint": "d80e5971a9bc76b5f67d96124b32eaef36ad8904",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "b938f6b56e2ce7a0c4d4ce06c99d92da",
"path_pattern_hash": "c64fb925aa64878f95c3f56184f77f2c"
},
"target_context": {
"dst_port": 2250,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950319:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 176\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"evidence": {
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950319:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 176\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cb34625663294de056766076a3436c670096ef4b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 2250,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"attack_vector": "port scan syn \u00b7 via HTTP:2250 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"target_port_label": "2250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2250,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 2250,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:2250 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"target_port_label": "2250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2250"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.63,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950319:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:22 UTC
TCP
1207 · HTTP
Scan de ports
port scan syn · via HTTP:1207 · (reconnaissance) · → /v1/messages
Élevée
Moyen · 63
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /v1/messages UA axios/1.18.1
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
950470:nosqli-3
http_jwt_body
Cible HTTP
POST
/v1/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
1207
Chemin / cible
/v1/messages
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /v1/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
POST /v1/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
anthro
Requête brute (extrait)
POST /v1/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 199 Accept-Encoding: gzip, compress, deflate, br Host: 62.3
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "f3dc7b1e8742ef425fa4df89199a472507074d2f",
"http_target_hash": "db019ad17e38ba897d71591e9e52878ec973496c",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 470,
"payload_entropy": 5.2370796231571575,
"port_category": "registered",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 1207,
"risk_waf": 88,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "3f85dd7755366d8fac301bb39d7264f83e5bd8b0",
"event_fingerprint": "dcf775a155ccece29ef651c2247bf519683523e3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "9ef8b576da5649709f13a2562baa46bf",
"path_pattern_hash": "c64fb925aa64878f95c3f56184f77f2c"
},
"target_context": {
"dst_port": 1207,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"evidence": {
"method": "POST",
"path": "\/v1\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "POST \/v1\/messages HTTP\/1.1",
"request_sample": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 199\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHost: 62.3",
"payload_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "43626982e55c3a27615150bc86d48a455da78db4",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 1207,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"attack_vector": "port scan syn \u00b7 via HTTP:1207 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"target_port_label": "1207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1207,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/v1\/messages",
"request_line": "POST \/v1\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 1207,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:1207 \u00b7 (reconnaissance) \u00b7 \u2192 \/v1\/messages",
"evidence_snippet": "POST \/v1\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthro",
"target_port_label": "1207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1207"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.79,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"950470:nosqli-3",
"http_jwt_body",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}
31/07/2026 12:39:22 UTC
TCP
177 · HTTP
Scan de ports
port scan syn · via HTTP:177 · (reconnaissance) · → /anthropic/messages
Élevée
Moyen · 50
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /anthropic/messages UA axios/1.18.1
Émulateur
HTTP
WAF
12
Recommandation
Investiguer
Tags
950468:nosqli-3
950470:nosqli-3
http_mass_assignment
Cible HTTP
POST
/anthropic/messages
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
177
Chemin / cible
/anthropic/messages
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /anthropic/messages HTTP/1.1
User-Agent
axios/1.18.1
Règles WAF
nosqli-3
Payload (extrait)
POST /anthropic/messages HTTP/1.1
Accept: application/json, text/plain, */*
Content-Type: application/json
connection: close
Requête brute (extrait)
POST /anthropic/messages HTTP/1.1 Accept: application/json, text/plain, */* Content-Type: application/json connection: close anthropic-version: 2023-06-01 User-Agent: axios/1.18.1 Content-Length: 175 Accept-Encoding: gzip, compress, deflate, br Hos
Meta JSON brut
{
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "b7fd41a6113dbcd3961a3eb287554c2cbcb27f07",
"http_host_hash": "35def72dfb9b076fe79dbd3d4776154e9fb9664d",
"http_target_hash": "43e7caacf9ef14cae77115b86fe870c4267ea7ba",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 452,
"payload_entropy": 5.194630697323623,
"port_category": "well_known",
"org": "OVH SAS",
"service": "http",
"app_proto": "http",
"asn": 16276,
"country": "GB",
"dst_port": 177,
"risk_waf": 56,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 50,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d1e1057aee059ac1198edcfffa76fff1f4c183a9",
"event_fingerprint": "92537f15d5fe56d0151628da00cab5ee4b8b6c84",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 50,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "089a48611ad116c516d570ca8dad9e6e",
"payload_hash": "6e3e6cd4aeabe79fa3f61fae0c303840",
"path_pattern_hash": "134c8c19df8466a0488f4d696bc0689f"
},
"target_context": {
"dst_port": 177,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r",
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 175\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"evidence": {
"method": "POST",
"path": "\/anthropic\/messages",
"user_agent": "axios\/1.18.1",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"request_sample": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close\r\nanthropic-version: 2023-06-01\r\nUser-Agent: axios\/1.18.1\r\nContent-Length: 175\r\nAccept-Encoding: gzip, compress, deflate, br\r\nHos",
"payload_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d150a2aea8b515db0bc1b8870420855c200f17aa",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 177,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"attack_vector": "port scan syn \u00b7 via HTTP:177 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"target_port_label": "177 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 56,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 50,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 177,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/anthropic\/messages",
"request_line": "POST \/anthropic\/messages HTTP\/1.1",
"http_user_agent": "axios\/1.18.1",
"port": 177,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:177 \u00b7 (reconnaissance) \u00b7 \u2192 \/anthropic\/messages",
"evidence_snippet": "POST \/anthropic\/messages HTTP\/1.1\r\nAccept: application\/json, text\/plain, *\/*\r\nContent-Type: application\/json\r\nconnection: close",
"target_port_label": "177 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 56 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "177"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
177,
480,
1207,
2250,
3500,
9595,
10020,
25105
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 2.78,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http",
"port:10020",
"port:1207",
"port:16101",
"port:177",
"port:2250",
"port:25105",
"port:3500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"http_mass_assignment"
],
"asn_dc_heuristic": true
}