Fiche IP

Pays-Bas

204.76.203.4

Activité suspecte · risque 44/100

FAI Pfcloud UG (haftungsbeschrankt) Première vue 11/10/2026 08:51 UTC Dernière vue 16/10/2026 17:49 UTC Risque Moyen

Période 2026-09-16 → 2026-10-16

Moyen 44/100

24h 7j 30j 90j

Synthèse

Score de risque max. 44/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 11/10/2026 08:51 UTC

Dernière observation 16/10/2026 17:49 UTC

Événements (période) 391

MITRE ATT&CK principal TA0007 390 occurrences

Pourquoi listée

Type « Sonde port » (signaux protocolaires) · confiance 50%

Confiance 50 % — Score WAF 8

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

44/100 Confiance 50 % 391 événements DNSBL 127.0.0.3 TA0007

À faire

Reprendre le verdict DNSBL 127.0.0.3 (Sonde port) dans la règle ou le ticket.
Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC

Note de ticket

IP 204.76.203.4
Décision : Investiguer
Score max : 44/100 (Moyen)
Confiance : 50 %
Période : 2026-09-16 → 2026-10-16 · 391 événements
Motif : Type « Sonde port » (signaux protocolaires) · confiance 50%
DNSBL : 4.203.76.204.dnsbl.blacklistip.com → 127.0.0.3 (Sonde port)
MITRE : TA0007
FAI : Pfcloud UG (haftungsbeschrankt) · Pays-Bas

Comparaison ASN / FAI

ASN 51396 · 204.76.203.0/24 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 391 événements sur la période pour cette IP.

45.135.193.198 Sonde HTTP 16/10/2026 17:43 UTC
176.65.134.67 Sonde HTTP 16/10/2026 16:24 UTC
45.135.193.193 Sonde HTTP 16/10/2026 13:58 UTC
176.65.148.253 Sonde Minecraft 16/10/2026 12:35 UTC
176.65.148.226 Sonde Minecraft 16/10/2026 12:27 UTC
176.65.149.59 Cross-site scripting 16/10/2026 10:42 UTC
176.65.149.198 Sonde Minecraft 16/10/2026 08:57 UTC
45.135.194.42 Scan de ports 16/10/2026 04:10 UTC

Événements (filtres)

391

Première observation

11/10/2026 08:51 UTC

Dernière observation

16/10/2026 17:49 UTC

Dernière activité (filtres)

16/10/2026 17:49 UTC

Événements 7j

391

Ports distincts (7j)

391

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

IRC ALT TCP 1 BGP TCP 1 MATTERMOST TCP 1 SAP HANA TCP 1 BITCOIN TCP 1 TUXEDO WSL TCP 1

IRC ALT

BGP

MATTERMOST

SAP HANA

BITCOIN

TUXEDO WSL

Géolocalisation

Origine réseau déclarée

Pays-Bas unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Pfcloud UG (haftungsbeschrankt) 0 Port 3120 Sonde port

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

Sonde port · port 3120 · (sonde / probe)

Détails protocole

Aperçu payload

� slowstack.tv9

Port / service

3120

Raison confiance

Confiance 50 % — Motif catalogue confirmé

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0554

Confiance

50% Confiance modérée — signal unique

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

391 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

391 événement(s) — page 1/16

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
16/10/2026 17:49:59 UTC	TCP	3120	—	Sonde port 3120 Sonde port · port 3120 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3120 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":3120,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.2,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"29a86464c2e86077b51b1cf0c8da7513f14ab092","event_fingerprint":"a6d79f235f03f981a13443fc8674eaae6371850f","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":3120,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\…
16/10/2026 17:07:31 UTC	TCP	2094	—	Sonde port 2094 Sonde port · port 2094 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2094 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":2094,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.7,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"c705784fdbfa77a7a5d597df5b4afb4c4a99dc00","event_fingerprint":"23b1cb31fb42d61ffb706e66fd96b2cbaf09eaea","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":2094,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\…
16/10/2026 16:59:27 UTC	TCP	29457	—	Sonde port 29457 Sonde port · port 29457 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 29457 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":29457,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.1,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"d25c5b38ac1fe52eb84d52b71b41fc1c72ccd69d","event_fingerprint":"753dbfc62719f0421950cdbb3381007039880bde","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":29457,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u0005…
16/10/2026 16:52:04 UTC	TCP	12757	—	Sonde port 12757 Sonde port · port 12757 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 12757 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":12757,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"a94e296830522561ddd55a3428eb97f5441f05ee","event_fingerprint":"c97163d3cd6d08f9b98ea50d5dc4cff8b0c16f9d","classification_confidence":0.58,"confidence":0.58,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":12757,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u…
16/10/2026 16:48:23 UTC	TCP	24963	—	Sonde port 24963 Sonde port · port 24963 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 24963 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":24963,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.3,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"fed34d06adafdfe2683af5edb275e42b1cee191e","event_fingerprint":"5068ea30e882a5f2e9b66a7fae95a445a18851df","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":24963,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u0005…
16/10/2026 16:33:47 UTC	TCP	11298	—	Sonde port 11298 Sonde port · port 11298 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 11298 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":11298,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.2,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"4eaadcd32d5f3c1df9a5540a4a63d5684767ec9b","event_fingerprint":"7e03967d508bfe10968a8dd168134007124ddcab","classification_confidence":0.58,"confidence":0.58,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":11298,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u…
16/10/2026 16:30:59 UTC	TCP	26196	—	Sonde port 26196 Sonde port · port 26196 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 26196 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":26196,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.2,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"1f67414b64b2ca37d8a542e0a60bcf69fc465856","event_fingerprint":"87acc613159caaff3b9a06df2dc9d95b253de9f9","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":26196,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u0005…
16/10/2026 16:18:34 UTC	TCP	2640	—	Sonde port 2640 Sonde port · port 2640 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2640 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":2640,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.8,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"538f48738de59af08e010dbef97b2645b320769a","event_fingerprint":"5e9fc4715d49cc3e2f8e79f639496be6ea730969","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":2640,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\…
16/10/2026 14:59:57 UTC	TCP	3313	—	Sonde port 3313 Sonde port · port 3313 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3313 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":3313,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.3,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"8e134dd2c2eb97aba1b4d3be94f3c3f50aa6e6f2","event_fingerprint":"46f5e1a7467f6648527e3f0ed0ae2c1d3a4a3a7e","classification_confidence":0.58,"confidence":0.58,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":3313,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u00…
16/10/2026 14:58:25 UTC	TCP	17796	—	Sonde port 17796 Sonde port · port 17796 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 17796 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":17796,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.3,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"d9fa8845997a19de9f8da7b107d87e9f965e67f0","event_fingerprint":"39eeabbc511431fc4aca2fd28f215b62481cf299","classification_confidence":0.58,"confidence":0.58,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":17796,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u…
16/10/2026 14:56:43 UTC	TCP	26194	—	Sonde port 26194 Sonde port · port 26194 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 26194 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":26194,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.8,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"bb9ad7dbad394aa42bcf802e15aee4358b2dd91b","event_fingerprint":"2e66602f34432790007bd61f1d5dcd3cb4939fee","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":26194,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u0005…
16/10/2026 14:50:44 UTC	TCP	18345	—	Sonde port 18345 Sonde port · port 18345 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 18345 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":18345,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.8,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"124760ee7d6ba7f3262b422b3ba1f79c4629f80e","event_fingerprint":"56deebffa6c18f61f84f3842d73e0ffa9dab2dff","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":18345,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u0005…
16/10/2026 14:41:17 UTC	TCP	4682	—	Sonde port 4682 Sonde port · port 4682 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4682 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":4682,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.2,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"77d1ff8e72fabca70a20f0829635612e5c04d8dc","event_fingerprint":"85f04d8a548339e9463409a227e63a8c5f879de8","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":4682,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\…
16/10/2026 13:56:32 UTC	TCP	26424	—	Sonde port 26424 Sonde port · port 26424 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 26424 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":26424,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.9,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"e2da6c9b90dc230bcacc87bc19ad7d66572c3fa8","event_fingerprint":"46bc58c114d071677fd6798a9710f85fa7cd3ddd","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":26424,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u0005…
16/10/2026 13:38:34 UTC	TCP	30698	—	Sonde port 30698 Sonde port · port 30698 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 30698 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":30698,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.3,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"0662138c40e2f0d49a26b6f2edf459d381d05f1e","event_fingerprint":"f137b8b81049437017e424f3e0c5992715019990","classification_confidence":0.58,"confidence":0.58,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":30698,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u…
16/10/2026 13:37:43 UTC	TCP	1518	—	Sonde port 1518 Sonde port · port 1518 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1518 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":1518,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.8,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"73d3e13afcf6496bcca0e6c8556f3f65cf74fb82","event_fingerprint":"6d13564ca55795dd194371bb16ea6cfef08551c5","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":1518,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\…
16/10/2026 13:20:39 UTC	TCP	7031	—	Sonde port 7031 Sonde port · port 7031 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7031 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":7031,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"21f012a6dd56e6e5e57853d17daf414584454d4e","event_fingerprint":"57e845758d41f5c53b5c00d403eea5388c777d1b","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":7031,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0…
16/10/2026 12:35:58 UTC	TCP	19154	—	Sonde port 19154 Sonde port · port 19154 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 19154 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":19154,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.3,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"5be0aa0a3db4b0700f63e6fbd2cd9b99c2fc5e5c","event_fingerprint":"b7bde4d012b24c49253de543f5b1114507fa8488","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":19154,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u0005…
16/10/2026 12:29:48 UTC	TCP	27619	—	Sonde port 27619 Sonde port · port 27619 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 27619 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":27619,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.6,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"a2e92fcda95d9c347d2416db5e9710e1941d28c0","event_fingerprint":"f272f20bae9eae5a82f977f9ad8d65a507878726","classification_confidence":0.58,"confidence":0.58,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":27619,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u…
16/10/2026 12:27:46 UTC	TCP	17224	—	Sonde port 17224 Sonde port · port 17224 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 17224 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":17224,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"9b9450704849f497a186c1cb69f1fb5de0747868","event_fingerprint":"0a600959bac521c4d81007ec76fa34c8e9a630cf","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":17224,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\…
16/10/2026 12:06:54 UTC	TCP	32658	—	Sonde port 32658 Sonde port · port 32658 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 32658 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":32658,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.4,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"e51af4cfa0c2b00ed3adb00dc7ee2ce0f34a8f8b","event_fingerprint":"b37016e46d17cf73b1badcb5d0df4f72ec345e4c","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":32658,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u0005…
16/10/2026 11:55:49 UTC	TCP	1501	—	Sonde port 1501 Sonde port · port 1501 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1501 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":1501,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.1,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"c20783c332be098a866d183c80bf40f82a14d019","event_fingerprint":"d322c76a7dc999fab3721e6519eca6f4a8dc159c","classification_confidence":0.58,"confidence":0.58,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":1501,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u00…
16/10/2026 11:55:28 UTC	TCP	31749	—	Sonde port 31749 Sonde port · port 31749 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 31749 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":31749,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.8,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"11db59cb33c47ee8c9ebc7daeb4cb3529fdf2c03","event_fingerprint":"ac28e084b1ebe61bf4c726d1b290350d7da1fd73","classification_confidence":0.58,"confidence":0.58,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":31749,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u…
16/10/2026 11:53:33 UTC	TCP	2966	—	Sonde port 2966 Sonde port · port 2966 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2966 Chemin / cible — Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":null,"app_proto":null,"asn":51396,"country":"NL","dst_port":2966,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"303b2e87e6733e29458ae39179de4d8cd4d5d266","event_fingerprint":"6a9dfcfe9e7927574980e2d8538ab78154df0c15","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":2966,"risk_score":44},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","payload_snippet":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\…
16/10/2026 11:38:54 UTC	TCP	8334 · BITCOIN	bitcoin	Sonde Bitcoin bitcoin · via BITCOIN:8334 · (sonde / probe)	Faible	Faible · 8
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur BITCOIN WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8334 Chemin / cible — Service BITCOIN Payload � slowstack.tv9 Pourquoi cette classification : Type « Sonde Bitcoin » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 8 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �slowstack.tv9 Meta JSON brut {"bytes_in":22,"payload_entropy":4.095795255000932,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"bitcoin","app_proto":"bitcoin","asn":51396,"country":"NL","dst_port":8334,"risk_waf":8,"risk_classification":0,"risk_behavior":0,"risk_geo":0,"risk_protocol":22,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.2,"risk_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0},"risk_score":8,"tag_count":0,"anomaly_count":0,"campaign_key":"6937601d1ccd886accc37e6b869c8769dd70ec07","event_fingerprint":"0e16df5ae9109a064c38cc2c3bcae96ada7afb4d","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab bitcoin \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":8},"service_name":"bitcoin","risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b73d37d8f619ba726147eb4098ef6f7b","path_pattern_hash":"6b88c087247aa2f07ee1c5956b8e1a9f"},"target_context":{"dst_port":8334,"service":"bitcoin","service_name":"bitcoin","risk_score":8},"payload_preview":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u0001\u0000","request_sample":"\u0013\u0000\ufffd\u0006\fslowstack.tv\u00059\u0001\u000…

204.76.203.4

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence