02/11/2026 23:55:06 UTC
TCP
5908
—
Sonde port 5908
Sonde port · port 5908 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5908
Chemin / cible
—
Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Meta JSON brut
{"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Google LLC","service":null,"app_proto":null,"asn":396982,"country":"US","dst_port":5908,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":40,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.9,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":40,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"4088fcc401e6b3c4cf860e0ed9a0bf71e9670550","event_fingerprint":"929306ed407c31de77b2d6f602eea285d9476339","classification_confidence":0.5,"confidence":0.5,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":40,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"US","asn":396982,"org":"Google LLC","is_datacenter":true,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":5908,"risk_score":44},"attack_stage":"probe","mitre_tactics":["TA0007","TA0001"],"mitre":"TA0007","threat_family":["scanner"],"recommended_client_action":"monitor","policy_mode":"intelligence","sensor_role":"threat_intelligence","event_signature":"1a7d88a8fdb572a572dac47e023b894af1df3a1a","protocol_details":{"port":5908},"att…
30/10/2026 19:14:43 UTC
TCP
7547 · HTTP
SSRF
ssrf attack · via HTTP:7547 · (tentative d'exploit)
Élevée
Critique · 86
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1090
Accès
Exécution
Protocole
POST /
Émulateur
HTTP
WAF
29
Recommandation
Bloquer (recommandé)
Tags
950079:sqli-19
950327:rce-0
950407:ssrf-3
950471:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7547
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · Motif SSRF · confiance 100%
Confiance classification
100%
Risque capteur
Critique
· 86
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Ssrf
Upstream
Waf Score
Tactiques MITRE
Accès initial
Exécution
Ligne de requête
POST / HTTP/1.1
User-Agent
—
Règles WAF
sqli-19
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Content-Type: application/xml
Host: 62.3.50.33:7547
Content-Length: 639
<?xml version="1.0" encoding="UTF-
Requête brute (extrait)
POST / HTTP/1.1 Content-Type: application/xml Host: 62.3.50.33:7547 Content-Length: 639 <?xml version="1.0" encoding="UTF-8" standalone="no"?> <soap_env:Envelope xmlns:soap_env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap_enc="http://schema
Meta JSON brut
{"http_header_count":3,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":null,"http_host_hash":"89d87453121897c0b4544fa397f8c826335c2714","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"POST","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":734,"payload_entropy":5.438211042873268,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"US","dst_port":7547,"risk_waf":100,"risk_classification":84,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":25,"risk_boost":15,"risk_granularity":5.2,"risk_breakdown":{"waf":100,"classification":84,"behavior":0,"geo":40,"protocol":35,"novelty":25},"risk_score":86,"tag_count":10,"anomaly_count":0,"campaign_key":"5c27582938038c07d7e0eb0ca126b831a7cb2961","event_fingerprint":"066608c9ffe4e19b8a5f62c5c4e6e70f82a78933","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 Motif SSRF \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":110,"precision_signals":["INT-http_ssrf","INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-http_ssrf","INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":100,"classification":84,"behavior":0,"geo":40,"protocol":35,"novelty":25,"risk_score":86},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":100,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"U…
29/10/2026 21:52:58 UTC
TCP
5800 · HTTP
Scanner web
web scanner · via HTTP:5800 · (sonde / probe)
Élevée
Moyen · 47
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
Découverte
Accès
Protocole
GET / UA Hello from Palo Alto Networks, find out more about our scans in…
Émulateur
HTTP
WAF
23
Recommandation
Surveiller
Tags
950318:lfi-14
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
5800
Chemin / cible
/
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 47
Confiance : Confiance 100 % — 4 tag(s) WAF
Signaux
Scanner Palo Alto
Upstream
Waf Score
Tactiques MITRE
Découverte
Accès initial
Ligne de requête
GET / HTTP/1.1
User-Agent
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity
Règles WAF
lfi-14
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.0
User-Agent: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks
Requête brute (extrait)
GET / HTTP/1.0 User-Agent: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity Accept: */*
Meta JSON brut
{"http_header_count":2,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"689bfbab10519e1ecf247982c128c7460ee59d4d","http_host_hash":null,"http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":185,"payload_entropy":4.938089755714326,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"US","dst_port":5800,"risk_waf":57.5,"risk_classification":42,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":25,"risk_boost":0,"risk_granularity":2.2,"risk_breakdown":{"waf":57.5,"classification":42,"behavior":0,"geo":40,"protocol":35,"novelty":25},"risk_score":47,"tag_count":5,"anomaly_count":0,"campaign_key":"387a1cbae4aed431eaff9dd6fa3274c71afcb0b4","event_fingerprint":"115a3fbe6bc03d845792cb419b77879bc9c5fc59","classification_reason":"User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":147,"precision_signals":["INT-scanner-palo-alto","INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-scanner-palo-alto","INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":57.5,"classification":42,"behavior":0,"geo":40,"protocol":35,"novelty":25,"risk_score":47},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":100,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"c…