Renseignement sur les menaces

Émirats arabes unis

31.56.209.218

FAI Swissnet LLC Première vue 01/06/2026 04:49 UTC Dernière vue 20/06/2026 19:17 UTC Risque Critique

Période analysée : 2026-05-21 → 2026-06-20

Activité suspecte — risque 59/100 (Moyen) — MITRE TA0001 — confiance 58 % — via HTTP — multi-protocole (3 protocoles · 5 min)

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

100

Critique · Risque max (7j) Critique

Synthèse exécutive

Profil de menace

Score de risque 100/100 Critique

Première observation 01/06/2026 04:49 UTC

Dernière observation 20/06/2026 19:17 UTC

Événements (période) 30

MITRE ATT&CK principal TA0007 12 occurrences

Activité suspecte — risque 59/100 (Moyen) — MITRE TA0001 — confiance 58 % — via HTTP — multi-protocole (3 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Règle WAF « ssrf-3 » · confiance 50%

Confiance 58 % — Score WAF 100 · Bonus corrélation +8 · 4 tag(s) WAF

Comparaison ASN / FAI

ASN 209373 · 31.56.209.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 30 événements sur la période pour cette IP.

217.60.195.150 jenkins probe 20/06/2026 14:50 UTC
217.60.195.168 Tentative d'exploit 20/06/2026 12:44 UTC
217.60.195.160 Tentative d'exploit 20/06/2026 11:43 UTC
217.60.195.138 Sonde port 20/06/2026 02:20 UTC
31.56.209.8 Sonde port 19/06/2026 05:25 UTC
217.60.195.159 Sonde port 3372/TCP 18/06/2026 12:26 UTC
31.56.209.125 Sonde PostgreSQL 18/06/2026 11:09 UTC
31.56.209.231 jenkins probe 17/06/2026 10:08 UTC

Événements (filtres)

Première observation

01/06/2026 04:49 UTC

Dernière observation

20/06/2026 19:17 UTC

Dernière activité (filtres)

20/06/2026 19:17 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 10 TLS TCP 10

HTTP

TLS

Géolocalisation

Origine réseau déclarée

Émirats arabes unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Swissnet LLC 3 Port 7681 port_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

ssrf attack · via HTTP:7681 · (tentative d'exploit) · → /ws

Détails protocole

Méthode: GET
Chemin: /ws
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 S…

Aperçu payload

GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G

Port / service

7681 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 50 % — 4 tag(s) WAF

Technique MITRE

TA0001

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

Upstream Waf Score

Confiance

58% Corrélation +8

Famille de menace

ssrf_probe

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

30 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

30 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
20/06/2026 19:17:12 UTC	TCP	7681	—	Sonde port Sonde port · port 7681 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Swissnet LLC", "service": null, "app_proto": null, "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "6f7ce84f60174a92bfe1651bd14c15aca9ac8da4", "event_fingerprint": "b4012aa34fdeb067d5b2ceee817c0957de66bab6", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 7681, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6f1437eeddfbfa061e6200cf093bf4f6dcb983f8", "protocol_details": { "port": 7681 }, "attack_vector": "Sonde port \u00b7 port 7681 \u00b7 (sonde \/ probe)", "target_port_label": "7681", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 7681 }, "attack_vector": "Sonde port \u00b7 port 7681 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "7681", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
20/06/2026 19:17:12 UTC	TCP	7681 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:7681 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Service TLS Payload ��H��?\|T��(="�Pd)5Fs뤾�I �َ �@��<�L��ա��.tW��6�+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��H��?\|T��(="�Pd)5Fs뤾�I �َ�@��<�L��ա��.tW��6�+�/�,�0̨̩� �� [� Requête brute (extrait) ��H��?\|T��(="�Pd)5Fs뤾�I �َ �@��<�L��ա��.tW��6�+�/�,�0̨̩� �� [ � � 2+3��$�a�3��]t�5?��Ac�RA�Q5� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1479, "payload_entropy": 7.72591877753016, "port_category": "registered", "org": "Swissnet LLC", "service": "tls", "app_proto": "tls", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "320ed113a415c7dd5551ed1be394e4e708d6a2b6", "event_fingerprint": "156c81feb5f7fae91e79390fc9fdd6280c3c333f", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "d46a45ac35594ab86f4c54dfd0b18078", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 7681, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdH\ufffd\ufffd?\|\u0000T\b\ufffd\ufffd\ufffd\ufffd\ufffd(\u0018=\"\ufffdPd)5Fs\u0018\ub93e\ufffdI \ufffd\u064e\u000b\u001e\ufffd@\ufffd\ufffd<\ufffdL\ufffd\ufffd\ufffd\ufffd\u0017\u0561\ufffd\ufffd\ufffd.tW\ufffd\u000e\ufffd\u001b\u0005\ufffd6\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdH\ufffd\ufffd?\|\u0000T\b\ufffd\ufffd\ufffd\ufffd\ufffd(\u0018=\"\ufffdPd)5Fs\u0018\ub93e\ufffdI \ufffd\u064e\u000b\u001e\ufffd@\ufffd\ufffd<\ufffdL\ufffd\ufffd\ufffd\ufffd\u0017\u0561\ufffd\ufffd\ufffd.tW\ufffd\u000e\ufffd\u001b\u0005\ufffd6\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd$\ufffda\ufffd3\u0007\ufffd\ufffd]t\u0006\ufffd\u00135?\ufffd\ufffd\ufffd\ufffdA\u0019c\ufffdRA\ufffdQ5\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdH\ufffd\ufffd?\|\u0000T\b\ufffd\ufffd\ufffd\ufffd\ufffd(\u0018=\"\ufffdPd)5Fs\u0018\ub93e\ufffdI \ufffd\u064e\u000b\u001e\ufffd@\ufffd\ufffd<\ufffdL\ufffd\ufffd\ufffd\ufffd\u0017\u0561\ufffd\ufffd\ufffd.tW\ufffd\u000e\ufffd\u001b\u0005\ufffd6\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "28cf45550ae6b78fdacc2223d114f05ff354c68e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdH\ufffd\ufffd?\|\u0000T\b\ufffd\ufffd\ufffd\ufffd\ufffd(\u0018=\"\ufffdPd)5Fs\u0018\ub93e\ufffdI \ufffd\u064e\u000b\u001e\ufffd@\ufffd\ufffd<\ufffdL\ufffd\ufffd\ufffd\ufffd\u0017\u0561\ufffd\ufffd\ufffd.tW\ufffd\u000e\ufffd\u001b\u0005\ufffd6\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 7681, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdH\ufffd\ufffd?\|T\ufffd\ufffd\ufffd\ufffd\ufffd(=\"\ufffdPd)5Fs\ub93e\ufffdI \ufffd\u064e\ufffd@\ufffd\ufffd<\ufffdL\ufffd\ufffd\ufffd\ufffd\u0561\ufffd\ufffd\ufffd.tW\ufffd\ufffd\ufffd6\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:7681 \u00b7 (sonde \/ probe)", "target_port_label": "7681 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdH\ufffd\ufffd?\|\u0000T\b\ufffd\ufffd\ufffd\ufffd\ufffd(\u0018=\"\ufffdPd)5Fs\u0018\ub93e\ufffdI \ufffd\u064e\u000b\u001e\ufffd@\ufffd\ufffd<\ufffdL\ufffd\ufffd\ufffd\ufffd\u0017\u0561\ufffd\ufffd\ufffd.tW\ufffd\u000e\ufffd\u001b\u0005\ufffd6\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 7681, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:7681 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdH\ufffd\ufffd?\|T\ufffd\ufffd\ufffd\ufffd\ufffd(=\"\ufffdPd)5Fs\ub93e\ufffdI \ufffd\u064e\ufffd@\ufffd\ufffd<\ufffdL\ufffd\ufffd\ufffd\ufffd\u0561\ufffd\ufffd\ufffd.tW\ufffd\ufffd\ufffd6\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd", "target_port_label": "7681 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "port:7681", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
20/06/2026 19:17:12 UTC	TCP	7681 · HTTP	http	SSRF ssrf attack · via HTTP:7681 · (tentative d'exploit) · → /ws	Élevée	Moyen · 59
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /ws UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 24 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 951040:websocket-anomaly Cible HTTP GET /ws TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7681 Chemin / cible /ws Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 59 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /ws HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 websocket-anomaly Payload (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G Requête brute (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Cache-Control: no-cache Connection: Upgrade Origin: http://62.3.50.33:7681 Pragma: no-c Meta JSON brut { "http_header_count": 10, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "539ecdad151c9c9dc71f317e9e2fbae4aee81334", "http_host_hash": "6ffa2bf2355c4674df8d22606a6d4593716fe28e", "http_target_hash": "a70b33c6ff5b3c4ea91eaa80d93fee148b263f26", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 385, "payload_entropy": 5.481977124393797, "port_category": "registered", "org": "Swissnet LLC", "service": "http", "app_proto": "http", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 100, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 59, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c1dfa44de80450a0e270155b2bc324672e34c8ef", "event_fingerprint": "ff57c57e980bc994618a91417e90373bce9b27f1", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 59, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "df9c14bed57e6bde007625ceaa20e44f", "payload_hash": "6eb6e262f12a7cd41b43af2f144092bf", "path_pattern_hash": "0c65a812b078db6795486113db0a40a6" }, "target_context": { "dst_port": 7681, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "evidence": { "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "22907e46779c0a6cf3989e3a83ebe841d41209f4", "protocol_details": { "http_method": "GET", "http_path": "\/ws", "request_line": "GET \/ws HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 7681, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "attack_vector": "ssrf attack \u00b7 via HTTP:7681 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/ws", "target_port_label": "7681 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 59, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/ws", "request_line": "GET \/ws HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 7681, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:7681 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/ws", "evidence_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "target_port_label": "7681 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:7681", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "behavior_alert_count": 1, "behavior_priority": 96 }
18/06/2026 00:58:35 UTC	TCP	7681	—	Sonde port Sonde port · port 7681 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Swissnet LLC", "service": null, "app_proto": null, "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "6f7ce84f60174a92bfe1651bd14c15aca9ac8da4", "event_fingerprint": "b4012aa34fdeb067d5b2ceee817c0957de66bab6", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 7681, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6f1437eeddfbfa061e6200cf093bf4f6dcb983f8", "protocol_details": { "port": 7681 }, "attack_vector": "Sonde port \u00b7 port 7681 \u00b7 (sonde \/ probe)", "target_port_label": "7681", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 7681 }, "attack_vector": "Sonde port \u00b7 port 7681 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "7681", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
18/06/2026 00:58:35 UTC	TCP	7681 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:7681 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Service TLS Payload ��PLS�V��#S��k��Q)�-\|eK��Yɠ ��h<��56�!��7��[�Q)�=5��-�+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��PLS�V��#S��k��Q)�-\|eK��Yɠ ��h<��56�!��7��[�Q)�=5��-�+�/�,�0̨̩� �� [� Requête brute (extrait) ��PLS�V��#S��k��Q)�-\|eK��Yɠ ��h<��56�!��7��[�Q)�=5��-�+�/�,�0̨̩� �� [ � � 2+3��:��%a��<6�:V�h�d:t鲄� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1479, "payload_entropy": 7.723082787927864, "port_category": "registered", "org": "Swissnet LLC", "service": "tls", "app_proto": "tls", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "320ed113a415c7dd5551ed1be394e4e708d6a2b6", "event_fingerprint": "156c81feb5f7fae91e79390fc9fdd6280c3c333f", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "9a6bf77ea0bad7d45ecc2484775e7feb", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 7681, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdPLS\ufffdV\ufffd\ufffd#S\ufffd\ufffdk\ufffd\ufffdQ)\ufffd-\|eK\ufffd\ufffd\ufffd\ufffd\u0015Y\u0260 \ufffd\ufffdh<\u0019\ufffd\ufffd\u0018\ufffd56\u0019\ufffd!\ufffd\ufffd7\ufffd\ufffd\ufffd[\ufffdQ)\u0001\ufffd=5\ufffd\ufffd-\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdPLS\ufffdV\ufffd\ufffd#S\ufffd\ufffdk\ufffd\ufffdQ)\ufffd-\|eK\ufffd\ufffd\ufffd\ufffd\u0015Y\u0260 \ufffd\ufffdh<\u0019\ufffd\ufffd\u0018\ufffd56\u0019\ufffd!\ufffd\ufffd7\ufffd\ufffd\ufffd[\ufffdQ)\u0001\ufffd=5\ufffd\ufffd-\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd:\ufffd\ufffd%a\ufffd\ufffd\u0013<6\ufffd:V\u001b\u0000\ufffdh\ufffdd:t\u9c84\ufffd\u0005 ", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdPLS\ufffdV\ufffd\ufffd#S\ufffd\ufffdk\ufffd\ufffdQ)\ufffd-\|eK\ufffd\ufffd\ufffd\ufffd\u0015Y\u0260 \ufffd\ufffdh<\u0019\ufffd\ufffd\u0018\ufffd56\u0019\ufffd!\ufffd\ufffd7\ufffd\ufffd\ufffd[\ufffdQ)\u0001\ufffd=5\ufffd\ufffd-\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d95fbe88d6fc6e568b264256e4e81b269cd5d5c3", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdPLS\ufffdV\ufffd\ufffd#S\ufffd\ufffdk\ufffd\ufffdQ)\ufffd-\|eK\ufffd\ufffd\ufffd\ufffd\u0015Y\u0260 \ufffd\ufffdh<\u0019\ufffd\ufffd\u0018\ufffd56\u0019\ufffd!\ufffd\ufffd7\ufffd\ufffd\ufffd[\ufffdQ)\u0001\ufffd=5\ufffd\ufffd-\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 7681, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdPLS\ufffdV\ufffd\ufffd#S\ufffd\ufffdk\ufffd\ufffdQ)\ufffd-\|eK\ufffd\ufffd\ufffd\ufffdY\u0260 \ufffd\ufffdh<\ufffd\ufffd\ufffd56\ufffd!\ufffd\ufffd7\ufffd\ufffd\ufffd[\ufffdQ)\ufffd=5\ufffd\ufffd-\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:7681 \u00b7 (sonde \/ probe)", "target_port_label": "7681 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdPLS\ufffdV\ufffd\ufffd#S\ufffd\ufffdk\ufffd\ufffdQ)\ufffd-\|eK\ufffd\ufffd\ufffd\ufffd\u0015Y\u0260 \ufffd\ufffdh<\u0019\ufffd\ufffd\u0018\ufffd56\u0019\ufffd!\ufffd\ufffd7\ufffd\ufffd\ufffd[\ufffdQ)\u0001\ufffd=5\ufffd\ufffd-\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 7681, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:7681 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdPLS\ufffdV\ufffd\ufffd#S\ufffd\ufffdk\ufffd\ufffdQ)\ufffd-\|eK\ufffd\ufffd\ufffd\ufffdY\u0260 \ufffd\ufffdh<\ufffd\ufffd\ufffd56\ufffd!\ufffd\ufffd7\ufffd\ufffd\ufffd[\ufffdQ)\ufffd=5\ufffd\ufffd-\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd", "target_port_label": "7681 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "port:7681", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
18/06/2026 00:58:35 UTC	TCP	7681 · HTTP	http	SSRF ssrf attack · via HTTP:7681 · (tentative d'exploit) · → /ws	Élevée	Moyen · 59
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /ws UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 24 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 951040:websocket-anomaly Cible HTTP GET /ws TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7681 Chemin / cible /ws Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 59 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /ws HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 websocket-anomaly Payload (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G Requête brute (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Cache-Control: no-cache Connection: Upgrade Origin: http://62.3.50.33:7681 Pragma: no-c Meta JSON brut { "http_header_count": 10, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "539ecdad151c9c9dc71f317e9e2fbae4aee81334", "http_host_hash": "6ffa2bf2355c4674df8d22606a6d4593716fe28e", "http_target_hash": "a70b33c6ff5b3c4ea91eaa80d93fee148b263f26", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 385, "payload_entropy": 5.479471228398289, "port_category": "registered", "org": "Swissnet LLC", "service": "http", "app_proto": "http", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 100, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 59, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c1dfa44de80450a0e270155b2bc324672e34c8ef", "event_fingerprint": "ff57c57e980bc994618a91417e90373bce9b27f1", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 59, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "df9c14bed57e6bde007625ceaa20e44f", "payload_hash": "6eb6e262f12a7cd41b43af2f144092bf", "path_pattern_hash": "0c65a812b078db6795486113db0a40a6" }, "target_context": { "dst_port": 7681, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "evidence": { "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "22907e46779c0a6cf3989e3a83ebe841d41209f4", "protocol_details": { "http_method": "GET", "http_path": "\/ws", "request_line": "GET \/ws HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 7681, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "attack_vector": "ssrf attack \u00b7 via HTTP:7681 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/ws", "target_port_label": "7681 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 59, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/ws", "request_line": "GET \/ws HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 7681, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:7681 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/ws", "evidence_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "target_port_label": "7681 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:7681", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "behavior_alert_count": 1, "behavior_priority": 96 }
08/06/2026 12:54:09 UTC	TCP	7681	—	Sonde port Sonde port · port 7681 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Swissnet LLC", "service": null, "app_proto": null, "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "6f7ce84f60174a92bfe1651bd14c15aca9ac8da4", "event_fingerprint": "b4012aa34fdeb067d5b2ceee817c0957de66bab6", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 7681, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6f1437eeddfbfa061e6200cf093bf4f6dcb983f8", "protocol_details": { "port": 7681 }, "attack_vector": "Sonde port \u00b7 port 7681 \u00b7 (sonde \/ probe)", "target_port_label": "7681", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 7681 }, "attack_vector": "Sonde port \u00b7 port 7681 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "7681", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
08/06/2026 12:54:09 UTC	TCP	7681 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:7681 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Service TLS Payload ��Xҋ�}�+�V��d�-�0P��ӿ`�͕� ��}�[C�3�k�]��f:��e�nTR]�+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Xҋ�}�+�V��d�-�0P��ӿ`�͕� ��}�[C�3�k�]��f:��e�nTR]�+�/�,�0̨̩� �� [� Requête brute (extrait) ��Xҋ�}�+�V��d�-�0P��ӿ`�͕� ��}�[C�3�k�]��f:��e�nTR]�+�/�,�0̨̩� �� [ � � 2+3��ɍ�!#�kf�WfS ��b-�:�4� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1479, "payload_entropy": 7.724744246195982, "port_category": "registered", "org": "Swissnet LLC", "service": "tls", "app_proto": "tls", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "320ed113a415c7dd5551ed1be394e4e708d6a2b6", "event_fingerprint": "156c81feb5f7fae91e79390fc9fdd6280c3c333f", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "4787a90ce394f9a777b9933b95d661f6", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 7681, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003X\u048b\ufffd}\ufffd+\ufffd\u0002\u0001V\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd-\ufffd\u00010P\ufffd\ufffd\u04ff`\ufffd\u0355\ufffd \ufffd\ufffd\ufffd}\ufffd[C\ufffd3\ufffdk\u009c\ufffd]\ufffd\ufffd\ufffd\ufffd\u0018f:\u0011\ufffd\ufffde\ufffdnTR]\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003X\u048b\ufffd}\ufffd+\ufffd\u0002\u0001V\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd-\ufffd\u00010P\ufffd\ufffd\u04ff`\ufffd\u0355\ufffd \ufffd\ufffd\ufffd}\ufffd[C\ufffd3\ufffdk\u009c\ufffd]\ufffd\ufffd\ufffd\ufffd\u0018f:\u0011\ufffd\ufffde\ufffdnTR]\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0017\u024d\ufffd!\u001e#\ufffdkf\ufffdWf\u0006S\t\ufffd\ufffd\ufffd\ufffdb-\ufffd\u001f:\ufffd4\u001e\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003X\u048b\ufffd}\ufffd+\ufffd\u0002\u0001V\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd-\ufffd\u00010P\ufffd\ufffd\u04ff`\ufffd\u0355\ufffd \ufffd\ufffd\ufffd}\ufffd[C\ufffd3\ufffdk\u009c\ufffd]\ufffd\ufffd\ufffd\ufffd\u0018f:\u0011\ufffd\ufffde\ufffdnTR]\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "836ec531abc4ee52826f719b9e316df5721a96c9", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003X\u048b\ufffd}\ufffd+\ufffd\u0002\u0001V\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd-\ufffd\u00010P\ufffd\ufffd\u04ff`\ufffd\u0355\ufffd \ufffd\ufffd\ufffd}\ufffd[C\ufffd3\ufffdk\u009c\ufffd]\ufffd\ufffd\ufffd\ufffd\u0018f:\u0011\ufffd\ufffde\ufffdnTR]\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 7681, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdX\u048b\ufffd}\ufffd+\ufffdV\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd-\ufffd0P\ufffd\ufffd\u04ff`\ufffd\u0355\ufffd \ufffd\ufffd\ufffd}\ufffd[C\ufffd3\ufffdk\u009c\ufffd]\ufffd\ufffd\ufffd\ufffdf:\ufffd\ufffde\ufffdnTR]\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:7681 \u00b7 (sonde \/ probe)", "target_port_label": "7681 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003X\u048b\ufffd}\ufffd+\ufffd\u0002\u0001V\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd-\ufffd\u00010P\ufffd\ufffd\u04ff`\ufffd\u0355\ufffd \ufffd\ufffd\ufffd}\ufffd[C\ufffd3\ufffdk\u009c\ufffd]\ufffd\ufffd\ufffd\ufffd\u0018f:\u0011\ufffd\ufffde\ufffdnTR]\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 7681, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:7681 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdX\u048b\ufffd}\ufffd+\ufffdV\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd-\ufffd0P\ufffd\ufffd\u04ff`\ufffd\u0355\ufffd \ufffd\ufffd\ufffd}\ufffd[C\ufffd3\ufffdk\u009c\ufffd]\ufffd\ufffd\ufffd\ufffdf:\ufffd\ufffde\ufffdnTR]\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd", "target_port_label": "7681 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "port:7681", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
08/06/2026 12:54:09 UTC	TCP	7681 · HTTP	http	SSRF ssrf attack · via HTTP:7681 · (tentative d'exploit) · → /ws	Élevée	Moyen · 59
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /ws UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 24 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 951040:websocket-anomaly Cible HTTP GET /ws TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7681 Chemin / cible /ws Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 59 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /ws HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 websocket-anomaly Payload (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G Requête brute (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Cache-Control: no-cache Connection: Upgrade Origin: http://62.3.50.33:7681 Pragma: no-c Meta JSON brut { "http_header_count": 10, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "539ecdad151c9c9dc71f317e9e2fbae4aee81334", "http_host_hash": "6ffa2bf2355c4674df8d22606a6d4593716fe28e", "http_target_hash": "a70b33c6ff5b3c4ea91eaa80d93fee148b263f26", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 385, "payload_entropy": 5.461091320961914, "port_category": "registered", "org": "Swissnet LLC", "service": "http", "app_proto": "http", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 100, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 59, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c1dfa44de80450a0e270155b2bc324672e34c8ef", "event_fingerprint": "ff57c57e980bc994618a91417e90373bce9b27f1", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 59, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "df9c14bed57e6bde007625ceaa20e44f", "payload_hash": "6eb6e262f12a7cd41b43af2f144092bf", "path_pattern_hash": "0c65a812b078db6795486113db0a40a6" }, "target_context": { "dst_port": 7681, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "evidence": { "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "22907e46779c0a6cf3989e3a83ebe841d41209f4", "protocol_details": { "http_method": "GET", "http_path": "\/ws", "request_line": "GET \/ws HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 7681, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "attack_vector": "ssrf attack \u00b7 via HTTP:7681 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/ws", "target_port_label": "7681 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 59, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/ws", "request_line": "GET \/ws HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 7681, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:7681 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/ws", "evidence_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "target_port_label": "7681 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:7681", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "behavior_alert_count": 1, "behavior_priority": 96 }
08/06/2026 04:27:55 UTC	TCP	7681	—	Sonde port Sonde port · port 7681 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Swissnet LLC", "service": null, "app_proto": null, "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "6f7ce84f60174a92bfe1651bd14c15aca9ac8da4", "event_fingerprint": "b4012aa34fdeb067d5b2ceee817c0957de66bab6", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 7681, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6f1437eeddfbfa061e6200cf093bf4f6dcb983f8", "protocol_details": { "port": 7681 }, "attack_vector": "Sonde port \u00b7 port 7681 \u00b7 (sonde \/ probe)", "target_port_label": "7681", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 7681 }, "attack_vector": "Sonde port \u00b7 port 7681 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "7681", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
08/06/2026 04:27:55 UTC	TCP	7681 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:7681 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Service TLS Payload ��~�nZ� & ��I׈E=��ņ&� {�T�v�]��0��;�:��Q�3/�J�-(}��+�/�,�0̨̩� �� [ � Pourquoi cette classification :* Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��~�nZ� &��I׈E=��ņ&� {�T�v�]��0��;�:��Q�3/�J�-(}��+�/�,�0̨̩� �� [� Requête brute (extrait) ��~�nZ� & ��I׈E=��ņ&� {�T�v�]��0��;�:��Q�3/�J�-(}��+�/�,�0̨̩� �� [ � � 2+3��ٓk�[0��WJ��=�P��{[��_+ Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1479, "payload_entropy": 7.739628210836231, "port_category": "registered", "org": "Swissnet LLC", "service": "tls", "app_proto": "tls", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "320ed113a415c7dd5551ed1be394e4e708d6a2b6", "event_fingerprint": "156c81feb5f7fae91e79390fc9fdd6280c3c333f", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "e9b7269235196b306ff539cd590ab21e", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 7681, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001e\ufffd\ufffd\ufffd\u0006~\u0002\ufffdnZ\ufffd\n&\u0018\u000b\ufffd\ufffdI\u0006\u05c8E=\u0012\ufffd\ufffd\u0146&\u0012\ufffd\u0019 {\ufffd\u0003T\ufffdv\ufffd]\ufffd\ufffd\ufffd0\ufffd\ufffd;\ufffd:\ufffd\ufffdQ\ufffd3\/\ufffdJ\ufffd-\u0000(}\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001e\ufffd\ufffd\ufffd\u0006~\u0002\ufffdnZ\ufffd\n&\u0018\u000b\ufffd\ufffdI\u0006\u05c8E=\u0012\ufffd\ufffd\u0146&\u0012\ufffd\u0019 {\ufffd\u0003T\ufffdv\ufffd]\ufffd\ufffd\ufffd0\ufffd\ufffd;\ufffd:\ufffd\ufffdQ\ufffd3\/\ufffdJ\ufffd-\u0000(}\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0653k\ufffd[0\ufffd\ufffdWJ\u001a\ufffd\ufffd\ufffd=\ufffdP\ufffd\ufffd{[\u0018\u0019\ufffd\u0015\ufffd_+", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001e\ufffd\ufffd\ufffd\u0006~\u0002\ufffdnZ\ufffd\n&\u0018\u000b\ufffd\ufffdI\u0006\u05c8E=\u0012\ufffd\ufffd\u0146&\u0012\ufffd\u0019 {\ufffd\u0003T\ufffdv\ufffd]\ufffd\ufffd\ufffd0\ufffd\ufffd;\ufffd:\ufffd\ufffdQ\ufffd3\/\ufffdJ\ufffd-\u0000(}\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8c76cac2f3577037d06e25bf60e9047d06dd7fef", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001e\ufffd\ufffd\ufffd\u0006~\u0002\ufffdnZ\ufffd\n&\u0018\u000b\ufffd\ufffdI\u0006\u05c8E=\u0012\ufffd\ufffd\u0146&\u0012\ufffd\u0019 {\ufffd\u0003T\ufffdv\ufffd]\ufffd\ufffd\ufffd0\ufffd\ufffd;\ufffd:\ufffd\ufffdQ\ufffd3\/\ufffdJ\ufffd-\u0000(}\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 7681, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdnZ\ufffd\n&\ufffd\ufffdI\u05c8E=\ufffd\ufffd\u0146&\ufffd {\ufffdT\ufffdv\ufffd]\ufffd\ufffd\ufffd0\ufffd\ufffd;\ufffd:\ufffd\ufffdQ\ufffd3\/\ufffdJ\ufffd-(}\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:7681 \u00b7 (sonde \/ probe)", "target_port_label": "7681 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u001e\ufffd\ufffd\ufffd\u0006~\u0002\ufffdnZ\ufffd\n&\u0018\u000b\ufffd\ufffdI\u0006\u05c8E=\u0012\ufffd\ufffd\u0146&\u0012\ufffd\u0019 {\ufffd\u0003T\ufffdv\ufffd]\ufffd\ufffd\ufffd0\ufffd\ufffd;\ufffd:\ufffd\ufffdQ\ufffd3\/\ufffdJ\ufffd-\u0000(}\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 7681, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:7681 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdnZ\ufffd\n&\ufffd\ufffdI\u05c8E=\ufffd\ufffd\u0146&\ufffd {\ufffdT\ufffdv*\ufffd]\ufffd\ufffd\ufffd0\ufffd\ufffd;\ufffd:\ufffd\ufffdQ\ufffd3\/\ufffdJ\ufffd-(}\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd", "target_port_label": "7681 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "port:7681", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
08/06/2026 04:27:55 UTC	TCP	7681 · HTTP	http	SSRF ssrf attack · via HTTP:7681 · (tentative d'exploit) · → /ws	Élevée	Moyen · 59
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /ws UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 24 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 951040:websocket-anomaly Cible HTTP GET /ws TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7681 Chemin / cible /ws Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 59 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /ws HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 websocket-anomaly Payload (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G Requête brute (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Cache-Control: no-cache Connection: Upgrade Origin: http://62.3.50.33:7681 Pragma: no-c Meta JSON brut { "http_header_count": 10, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "539ecdad151c9c9dc71f317e9e2fbae4aee81334", "http_host_hash": "6ffa2bf2355c4674df8d22606a6d4593716fe28e", "http_target_hash": "a70b33c6ff5b3c4ea91eaa80d93fee148b263f26", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 385, "payload_entropy": 5.4668092837995115, "port_category": "registered", "org": "Swissnet LLC", "service": "http", "app_proto": "http", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 100, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 59, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c1dfa44de80450a0e270155b2bc324672e34c8ef", "event_fingerprint": "ff57c57e980bc994618a91417e90373bce9b27f1", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 59, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "df9c14bed57e6bde007625ceaa20e44f", "payload_hash": "6eb6e262f12a7cd41b43af2f144092bf", "path_pattern_hash": "0c65a812b078db6795486113db0a40a6" }, "target_context": { "dst_port": 7681, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "evidence": { "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "22907e46779c0a6cf3989e3a83ebe841d41209f4", "protocol_details": { "http_method": "GET", "http_path": "\/ws", "request_line": "GET \/ws HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 7681, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "attack_vector": "ssrf attack \u00b7 via HTTP:7681 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/ws", "target_port_label": "7681 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 59, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/ws", "request_line": "GET \/ws HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 7681, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:7681 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/ws", "evidence_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "target_port_label": "7681 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:7681", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "behavior_alert_count": 1, "behavior_priority": 96 }
07/06/2026 17:58:51 UTC	TCP	7681	—	Sonde port Sonde port · port 7681 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Swissnet LLC", "service": null, "app_proto": null, "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "6f7ce84f60174a92bfe1651bd14c15aca9ac8da4", "event_fingerprint": "b4012aa34fdeb067d5b2ceee817c0957de66bab6", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 7681, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6f1437eeddfbfa061e6200cf093bf4f6dcb983f8", "protocol_details": { "port": 7681 }, "attack_vector": "Sonde port \u00b7 port 7681 \u00b7 (sonde \/ probe)", "target_port_label": "7681", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 50 %", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "INT-single-port" ], "tags_summary_labels_fr": [ "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 7681 }, "attack_vector": "Sonde port \u00b7 port 7681 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "7681", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
07/06/2026 17:58:51 UTC	TCP	7681 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:7681 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Service TLS Payload ��\�wj�~�v&��KQ$��ET��2��s� J��Q��c��a\��]�K��E,��+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��\�wj�~�v&��KQ$��ET��2��s� J��Q��c��a\��]�K��E,��+�/�,�0̨̩� �� [� Requête brute (extrait) ��\�wj�~�v&��KQ$��ET��2��s� J��Q��c��a\��]�K��E,��+�/�,�0̨̩� �� [ � � 2+3��_ L5Z� 73�U��TgP��lW�e� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1479, "payload_entropy": 7.7382505608925705, "port_category": "registered", "org": "Swissnet LLC", "service": "tls", "app_proto": "tls", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "320ed113a415c7dd5551ed1be394e4e708d6a2b6", "event_fingerprint": "156c81feb5f7fae91e79390fc9fdd6280c3c333f", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "fad6a359fb18b48cd87cbbcf7c5e7244", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 7681, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\\\ufffdwj\ufffd~\ufffd\u001fv&\ufffd\ufffd\u0000\ufffd\ufffdKQ$\ufffd\ufffd\u0001ET\ufffd\ufffd\u001e2\ufffd\ufffds\ufffd\n J\ufffd\ufffd\ufffd\u001a\u001f\ufffdQ\ufffd\u0012\ufffd\u000fc\u0001\ufffd\ufffda\\\ufffd\ufffd\u0015\ufffd\ufffd]\ufffdK\ufffd\ufffdE,\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\\\ufffdwj\ufffd~\ufffd\u001fv&\ufffd\ufffd\u0000\ufffd\ufffdKQ$\ufffd\ufffd\u0001ET\ufffd\ufffd\u001e2\ufffd\ufffds\ufffd\n J\ufffd\ufffd\ufffd\u001a\u001f\ufffdQ\ufffd\u0012\ufffd\u000fc\u0001\ufffd\ufffda\\\ufffd\ufffd\u0015\ufffd\ufffd]\ufffdK\ufffd\ufffdE,\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\ufffd_\fL5Z\ufffd\f73\u0014\ufffdU\ufffd\ufffd\ufffdTgP\ufffd\ufffdlW\ufffde\ufffd\u0002", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\\\ufffdwj\ufffd~\ufffd\u001fv&\ufffd\ufffd\u0000\ufffd\ufffdKQ$\ufffd\ufffd\u0001ET\ufffd\ufffd\u001e2\ufffd\ufffds\ufffd\n J\ufffd\ufffd\ufffd\u001a\u001f\ufffdQ\ufffd\u0012\ufffd\u000fc\u0001\ufffd\ufffda\\\ufffd\ufffd\u0015\ufffd\ufffd]\ufffdK\ufffd\ufffdE,\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ea90e416a9c67f756f11c28265bece7063697e70", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\\\ufffdwj\ufffd~\ufffd\u001fv&\ufffd\ufffd\u0000\ufffd\ufffdKQ$\ufffd\ufffd\u0001ET\ufffd\ufffd\u001e2\ufffd\ufffds\ufffd\n J\ufffd\ufffd\ufffd\u001a\u001f\ufffdQ\ufffd\u0012\ufffd\u000fc\u0001\ufffd\ufffda\\\ufffd\ufffd\u0015\ufffd\ufffd]\ufffdK\ufffd\ufffdE,\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 7681, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\\\ufffdwj\ufffd~\ufffdv&\ufffd\ufffd\ufffd\ufffdKQ$\ufffd\ufffdET\ufffd\ufffd2\ufffd\ufffds\ufffd\n J\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffdc\ufffd\ufffda\\\ufffd\ufffd\ufffd\ufffd]\ufffdK\ufffd\ufffdE,\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:7681 \u00b7 (sonde \/ probe)", "target_port_label": "7681 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0007 \u2014 confiance 57 % \u2014 via TLS \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\\\ufffdwj\ufffd~\ufffd\u001fv&\ufffd\ufffd\u0000\ufffd\ufffdKQ$\ufffd\ufffd\u0001ET\ufffd\ufffd\u001e2\ufffd\ufffds\ufffd\n J\ufffd\ufffd\ufffd\u001a\u001f\ufffdQ\ufffd\u0012\ufffd\u000fc\u0001\ufffd\ufffda\\\ufffd\ufffd\u0015\ufffd\ufffd]\ufffdK\ufffd\ufffdE,\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 7681, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:7681 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\\\ufffdwj\ufffd~\ufffdv&\ufffd\ufffd\ufffd\ufffdKQ$\ufffd\ufffdET\ufffd\ufffd2\ufffd\ufffds\ufffd\n J\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffdc\ufffd\ufffda\\\ufffd\ufffd\ufffd\ufffd]\ufffdK\ufffd\ufffdE,\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd[\ufffd", "target_port_label": "7681 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "port:7681", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
07/06/2026 17:58:51 UTC	TCP	7681 · HTTP	http	SSRF ssrf attack · via HTTP:7681 · (tentative d'exploit) · → /ws	Élevée	Moyen · 59
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /ws UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 24 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 951040:websocket-anomaly Cible HTTP GET /ws TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7681 Chemin / cible /ws Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 59 Confiance : Confiance 50 % — 4 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /ws HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 websocket-anomaly Payload (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G Requête brute (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Cache-Control: no-cache Connection: Upgrade Origin: http://62.3.50.33:7681 Pragma: no-c Meta JSON brut { "http_header_count": 10, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "539ecdad151c9c9dc71f317e9e2fbae4aee81334", "http_host_hash": "6ffa2bf2355c4674df8d22606a6d4593716fe28e", "http_target_hash": "a70b33c6ff5b3c4ea91eaa80d93fee148b263f26", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 385, "payload_entropy": 5.502166678538175, "port_category": "registered", "org": "Swissnet LLC", "service": "http", "app_proto": "http", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 100, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 59, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c1dfa44de80450a0e270155b2bc324672e34c8ef", "event_fingerprint": "ff57c57e980bc994618a91417e90373bce9b27f1", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 59, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "df9c14bed57e6bde007625ceaa20e44f", "payload_hash": "6eb6e262f12a7cd41b43af2f144092bf", "path_pattern_hash": "0c65a812b078db6795486113db0a40a6" }, "target_context": { "dst_port": 7681, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "evidence": { "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "22907e46779c0a6cf3989e3a83ebe841d41209f4", "protocol_details": { "http_method": "GET", "http_path": "\/ws", "request_line": "GET \/ws HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 7681, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "attack_vector": "ssrf attack \u00b7 via HTTP:7681 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/ws", "target_port_label": "7681 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 59, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/ws", "request_line": "GET \/ws HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 7681, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:7681 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/ws", "evidence_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "target_port_label": "7681 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:7681", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "behavior_alert_count": 1, "behavior_priority": 96 }
07/06/2026 13:24:09 UTC	TCP	7681	—	Sonde port	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Signaux Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Swissnet LLC", "service": null, "app_proto": null, "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "6f7ce84f60174a92bfe1651bd14c15aca9ac8da4", "event_fingerprint": "b4012aa34fdeb067d5b2ceee817c0957de66bab6", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 7681, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6f1437eeddfbfa061e6200cf093bf4f6dcb983f8", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "INT-single-port" ], "tags_summary_labels_fr": [ "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
07/06/2026 13:24:09 UTC	TCP	7681 · HTTP	http	SSRF	Élevée	Élevé · 68
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 WAF 24 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 951040:websocket-anomaly Cible HTTP GET /ws TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7681 Chemin / cible /ws Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Élevé · 68 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /ws HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 websocket-anomaly Payload (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G Requête brute (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Cache-Control: no-cache Connection: Upgrade Origin: http://ttyd Pragma: no-cache Sec-W Meta JSON brut { "http_header_count": 10, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "539ecdad151c9c9dc71f317e9e2fbae4aee81334", "http_host_hash": "6ffa2bf2355c4674df8d22606a6d4593716fe28e", "http_target_hash": "a70b33c6ff5b3c4ea91eaa80d93fee148b263f26", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 374, "payload_entropy": 5.451614888035334, "port_category": "registered", "org": "Swissnet LLC", "service": "http", "app_proto": "http", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 100, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 8, "risk_granularity": 5.6, "risk_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 68, "tag_count": 5, "anomaly_count": 0, "campaign_key": "42645bf2d5308eb8c4103a175dd5c07320e37bea", "event_fingerprint": "ff57c57e980bc994618a91417e90373bce9b27f1", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 68 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "df9c14bed57e6bde007625ceaa20e44f", "payload_hash": "648dd3b567c25849c571b2a006285c22", "path_pattern_hash": "0c65a812b078db6795486113db0a40a6" }, "target_context": { "dst_port": 7681, "service": "http", "service_name": "http", "risk_score": 68 }, "payload_preview": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/ttyd\r\nPragma: no-cache\r\nSec-W", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "evidence": { "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/ttyd\r\nPragma: no-cache\r\nSec-W", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "915254bc691a23acc95f812d7c38b054f0960127", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence_pct": 50, "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 68 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 68, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly", "http_websocket_anomaly" ], "behavior_alert_count": 1, "behavior_priority": 96 }
07/06/2026 13:24:09 UTC	TCP	7681 · TLS	tls	Sonde PostgreSQL	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Ӝ��0(Hϧza@_��ؾƫ0�(�yF�+S �,��6=��'^&+AYFw�V��3E��e��a}�+�/�,�0̨̩� �� [� Requête brute (extrait) ��Ӝ��0(Hϧza@_��ؾƫ0�(�yF�+S �,��6=��'^& +AYFw�V��3E��e��a}�+�/�,�0̨̩� �� [ � � 2+3��I]X��sӏٶ�W�Ҋ�� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1479, "payload_entropy": 7.74686998756983, "port_category": "registered", "org": "Swissnet LLC", "service": "tls", "app_proto": "tls", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "320ed113a415c7dd5551ed1be394e4e708d6a2b6", "event_fingerprint": "156c81feb5f7fae91e79390fc9fdd6280c3c333f", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "a325f233fc265289e630a34b4e588dcd", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 7681, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u04dc\ufffd\ufffd\ufffd0(H\u0013\u03e7za@_\ufffd\ufffd\ufffd\u063e\u01ab0\ufffd(\ufffdyF\ufffd+S\u0002 \ufffd,\ufffd\ufffd\ufffd\ufffd6=\ufffd\ufffd'^&\f+AYFw\ufffdV\ufffd\ufffd3E\ufffd\ufffde\ufffd\ufffda}\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u04dc\ufffd\ufffd\ufffd0(H\u0013\u03e7za@_\ufffd\ufffd\ufffd\u063e\u01ab0\ufffd(\ufffdyF\ufffd+S\u0002 \ufffd,\ufffd\ufffd\ufffd\ufffd6=\ufffd\ufffd'^&\f+AYFw\ufffdV\ufffd\ufffd3E\ufffd\ufffde\ufffd\ufffda}\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u001c\ufffd\ufffd\u001b\ufffdI]X\ufffd\ufffds\u04cf\u0016\u0676\ufffdW\ufffd\u0016\u048a\ufffd\u0007\u0015\ufffd\t", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u04dc\ufffd\ufffd\ufffd0(H\u0013\u03e7za@_\ufffd\ufffd\ufffd\u063e\u01ab0\ufffd(\ufffdyF\ufffd+S\u0002 \ufffd,\ufffd\ufffd\ufffd\ufffd6=\ufffd\ufffd'^&\f+AYFw\ufffdV\ufffd\ufffd3E\ufffd\ufffde\ufffd\ufffda}\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u04dc\ufffd\ufffd\ufffd0(H\u0013\u03e7za@_\ufffd\ufffd\ufffd\u063e\u01ab0\ufffd(\ufffdyF\ufffd+S\u0002 \ufffd,\ufffd\ufffd\ufffd\ufffd6=\ufffd\ufffd'^&\f+AYFw\ufffdV\ufffd\ufffd3E\ufffd\ufffde\ufffd\ufffda}\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u001c\ufffd\ufffd\u001b\ufffdI]X\ufffd\ufffds\u04cf\u0016\u0676\ufffdW\ufffd\u0016\u048a\ufffd\u0007\u0015\ufffd\t", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u04dc\ufffd\ufffd\ufffd0(H\u0013\u03e7za@_\ufffd\ufffd\ufffd\u063e\u01ab0\ufffd(\ufffdyF\ufffd+S\u0002 \ufffd,\ufffd\ufffd\ufffd\ufffd6=\ufffd\ufffd'^&\f+AYFw\ufffdV\ufffd\ufffd3E\ufffd\ufffde\ufffd\ufffda}\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "98b0c4ae7340b63ac292a2893f27dbacd3499994", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7681, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
07/06/2026 09:26:24 UTC	TCP	7681	—	Sonde port	Faible	Moyen · 44
Étape Sonde / probe MITRE TA0007 TA0007 TA0001 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Risque capteur Moyen · 44 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Swissnet LLC", "service": null, "app_proto": null, "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "6f7ce84f60174a92bfe1651bd14c15aca9ac8da4", "event_fingerprint": "b4012aa34fdeb067d5b2ceee817c0957de66bab6", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 7681, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6f1437eeddfbfa061e6200cf093bf4f6dcb983f8", "site_display": { "classification": "port_probe", "confidence_pct": 50, "confidence_breakdown": { "classification": 0.34, "kb_score": 40, "rule_count": 1, "payload_proof": false, "pattern_proof": false }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "dst_port": 7681, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "sensor_role": "threat_intelligence" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
07/06/2026 09:26:24 UTC	TCP	7681 · HTTP	http	SSRF	Élevée	Moyen · 59
Étape Tentative d'exploit MITRE TA0001 TA0001 TA0002 WAF 24 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 951040:websocket-anomaly Cible HTTP GET /ws TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7681 Chemin / cible /ws Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Risque capteur Moyen · 59 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /ws HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 websocket-anomaly Payload (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G Requête brute (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Cache-Control: no-cache Connection: Upgrade Origin: http://62.3.50.33:7681 Pragma: no-c Meta JSON brut { "http_header_count": 10, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "539ecdad151c9c9dc71f317e9e2fbae4aee81334", "http_host_hash": "6ffa2bf2355c4674df8d22606a6d4593716fe28e", "http_target_hash": "a70b33c6ff5b3c4ea91eaa80d93fee148b263f26", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 385, "payload_entropy": 5.460911567062163, "port_category": "registered", "org": "Swissnet LLC", "service": "http", "app_proto": "http", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 100, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 59, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c1dfa44de80450a0e270155b2bc324672e34c8ef", "event_fingerprint": "ff57c57e980bc994618a91417e90373bce9b27f1", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 59 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "df9c14bed57e6bde007625ceaa20e44f", "payload_hash": "6eb6e262f12a7cd41b43af2f144092bf", "path_pattern_hash": "0c65a812b078db6795486113db0a40a6" }, "target_context": { "dst_port": 7681, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "evidence": { "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "22907e46779c0a6cf3989e3a83ebe841d41209f4", "site_display": { "classification": "ssrf_attack", "confidence_pct": 50, "confidence_breakdown": { "classification": 0.5, "kb_score": 55, "rule_count": 2, "payload_proof": false, "pattern_proof": false }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "dst_port": 7681, "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "sensor_role": "threat_intelligence" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "behavior_alert_count": 1, "behavior_priority": 96 }
07/06/2026 09:26:24 UTC	TCP	7681 · TLS	tls	Sonde PostgreSQL	Moyenne	Faible · 35
Étape Sonde / probe MITRE TA0007 TA0007 TA0001 WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Risque capteur Faible · 35 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��\��3� #luȣ��g��LJA�� !P0��NQь��#�=)�uƻ�J�SF��+�/�,�0̨̩� �� [� Requête brute (extrait) ��\��3� #luȣ��g��LJA�� !P0��NQь��#�=)�uƻ�J�SF��+�/�,�0̨̩� �� [ � � 2+3��Z�e��ژ󩶄Z<�8�ݖ�"�� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1479, "payload_entropy": 7.695527846497729, "port_category": "registered", "org": "Swissnet LLC", "service": "tls", "app_proto": "tls", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "320ed113a415c7dd5551ed1be394e4e708d6a2b6", "event_fingerprint": "156c81feb5f7fae91e79390fc9fdd6280c3c333f", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "1e6f12772dff348ce1261b09957a999c", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 7681, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0007\ufffd\u0010\\\ufffd\ufffd\u00003\ufffd\r#lu\u0223\ufffd\ufffdg\ufffd\u001a\ufffdLJA\ufffd\ufffd\ufffd\ufffd\ufffd\f !P0\ufffd\ufffd\u0005\u001e\ufffdNQ\u044c\ufffd\ufffd#\ufffd=)\ufffdu\u01bb\ufffd\u0002J\ufffdSF\ufffd\u0007\u0010\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0007\ufffd\u0010\\\ufffd\ufffd\u00003\ufffd\r#lu\u0223\ufffd\ufffdg\ufffd\u001a\ufffdLJA\ufffd\ufffd\ufffd\ufffd\ufffd\f !P0\ufffd\ufffd\u0005\u001e\ufffdNQ\u044c\ufffd\ufffd#\ufffd=)\ufffdu\u01bb\ufffd\u0002J\ufffdSF\ufffd\u0007\u0010\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u001d\ufffdZ\ufffde\ufffd\ufffd\u0698\udb67\udd84Z<\u0015\u0004\ufffd8\ufffd\u0756\u001a\ufffd\"\ufffd\ufffd\u0001", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0007\ufffd\u0010\\\ufffd\ufffd\u00003\ufffd\r#lu\u0223\ufffd\ufffdg\ufffd\u001a\ufffdLJA\ufffd\ufffd\ufffd\ufffd\ufffd\f !P0\ufffd\ufffd\u0005\u001e\ufffdNQ\u044c\ufffd\ufffd#\ufffd=)\ufffdu\u01bb\ufffd\u0002J\ufffdSF\ufffd\u0007\u0010\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0007\ufffd\u0010\\\ufffd\ufffd\u00003\ufffd\r#lu\u0223\ufffd\ufffdg\ufffd\u001a\ufffdLJA\ufffd\ufffd\ufffd\ufffd\ufffd\f !P0\ufffd\ufffd\u0005\u001e\ufffdNQ\u044c\ufffd\ufffd#\ufffd=)\ufffdu\u01bb\ufffd\u0002J\ufffdSF\ufffd\u0007\u0010\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u001d\ufffdZ\ufffde\ufffd\ufffd\u0698\udb67\udd84Z<\u0015\u0004\ufffd8\ufffd*\u0756\u001a\ufffd\"\ufffd\ufffd\u0001", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0007\ufffd\u0010\\\ufffd\ufffd\u00003\ufffd\r#lu\u0223\ufffd\ufffdg\ufffd\u001a\ufffdLJA\ufffd\ufffd\ufffd\ufffd\ufffd\f !P0\ufffd\ufffd\u0005\u001e\ufffdNQ\u044c\ufffd\ufffd#\ufffd=)\ufffdu\u01bb\ufffd\u0002J\ufffdSF\ufffd\u0007\u0010\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c6cf0b9e5f3a03b2ecac9ee13b71d14092e1ff96", "site_display": { "classification": "postgres_probe", "confidence_pct": 49, "confidence_breakdown": { "classification": 0.49, "kb_score": 58, "rule_count": 1, "payload_proof": false, "pattern_proof": true }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "dst_port": 7681, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "sensor_role": "threat_intelligence" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7681" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
06/06/2026 20:11:52 UTC	TCP	7681	—	Sonde port	Faible	Faible · 18
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Swissnet LLC", "service": null, "app_proto": null, "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 18, "tag_count": 0, "anomaly_count": 0, "campaign_key": "6f7ce84f60174a92bfe1651bd14c15aca9ac8da4", "event_fingerprint": "b4012aa34fdeb067d5b2ceee817c0957de66bab6", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-single-port" ], "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 7681 }, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6f1437eeddfbfa061e6200cf093bf4f6dcb983f8", "ban_policy": "advisory_monitor" }
06/06/2026 20:11:52 UTC	TCP	7681	http	SSRF	Élevée	Moyen · 59
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 24 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 951040:websocket-anomaly Cible HTTP GET /ws TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7681 Chemin / cible /ws Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /ws HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 websocket-anomaly Payload (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G Requête brute (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Cache-Control: no-cache Connection: Upgrade Origin: http://62.3.50.33:7681 Pragma: no-c Meta JSON brut { "http_header_count": 10, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "539ecdad151c9c9dc71f317e9e2fbae4aee81334", "http_host_hash": "6ffa2bf2355c4674df8d22606a6d4593716fe28e", "http_target_hash": "a70b33c6ff5b3c4ea91eaa80d93fee148b263f26", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 385, "payload_entropy": 5.496723790384662, "port_category": "registered", "org": "Swissnet LLC", "service": "http", "app_proto": "http", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 100, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 59, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c1dfa44de80450a0e270155b2bc324672e34c8ef", "event_fingerprint": "ff57c57e980bc994618a91417e90373bce9b27f1", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "df9c14bed57e6bde007625ceaa20e44f", "payload_hash": "6eb6e262f12a7cd41b43af2f144092bf", "path_pattern_hash": "0c65a812b078db6795486113db0a40a6" }, "target_context": { "dst_port": 7681, "service": "http" }, "payload_preview": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "evidence": { "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "22907e46779c0a6cf3989e3a83ebe841d41209f4", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "behavior_alert_count": 1, "behavior_priority": 96 }
06/06/2026 20:11:52 UTC	TCP	7681	tls	Sonde TLS	Moyenne	Faible · 6
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��E[d��-�R�N�!ڣު��?�� ' �M�1��5<��b��Z�FoVV�r8�+�/�,�0̨̩� �� [� Requête brute (extrait) ��E[ d��-�R�N�!ڣު��?�� ' �M�1��5<��b��Z�FoVV�r8�+�/�,�0̨̩� �� [ � � 2+3��r�M<��[��<�v[Bu@��+�- Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1479, "payload_entropy": 7.735814146307229, "port_category": "registered", "org": "Swissnet LLC", "service": "tls", "app_proto": "tls", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 6, "tag_count": 2, "anomaly_count": 0, "campaign_key": "320ed113a415c7dd5551ed1be394e4e708d6a2b6", "event_fingerprint": "156c81feb5f7fae91e79390fc9fdd6280c3c333f", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "3d6b8034465338e9486eafb8ad221977", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 7681, "service": "tls" }, "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0001E[\u0007\fd\ufffd\ufffd\ufffd\b\u001e\ufffd-\ufffdR\ufffdN\ufffd!\u06a3\u07aa\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffd \ufffd'\n\ufffdM\ufffd1\u0005\ufffd\ufffd5\u0019<\ufffd\ufffd\ufffdb\ufffd\ufffd\u000e\ufffd\ufffdZ\ufffdFoV\u000eV\ufffdr8\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0001E[\u0007\fd\ufffd\ufffd\ufffd\b\u001e\ufffd-\ufffdR\ufffdN\ufffd!\u06a3\u07aa\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffd \ufffd'\n\ufffdM\ufffd1\u0005\ufffd\ufffd5\u0019<\ufffd\ufffd\ufffdb\ufffd\ufffd\u000e\ufffd\ufffdZ\ufffdFoV\u000eV\ufffdr8\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdr\ufffdM<\ufffd\u001f\ufffd\ufffd\ufffd[\ufffd\u001d\ufffd\u0012<\ufffdv[Bu@\ufffd\ufffd\ufffd\ufffd+\ufffd\u0000-", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0001E[\u0007\fd\ufffd\ufffd\ufffd\b\u001e\ufffd-\ufffdR\ufffdN\ufffd!\u06a3\u07aa\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffd \ufffd'\n\ufffdM\ufffd1\u0005\ufffd\ufffd5\u0019<\ufffd\ufffd\ufffdb\ufffd\ufffd\u000e\ufffd\ufffdZ\ufffdFoV\u000eV\ufffdr8\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0001E[\u0007\fd\ufffd\ufffd\ufffd\b\u001e\ufffd-\ufffdR\ufffdN\ufffd!\u06a3\u07aa\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffd \ufffd'\n\ufffdM\ufffd1\u0005\ufffd\ufffd5\u0019<\ufffd\ufffd\ufffdb\ufffd\ufffd\u000e\ufffd\ufffdZ\ufffdFoV\u000eV\ufffdr8\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdr\ufffdM<\ufffd\u001f\ufffd\ufffd\ufffd[\ufffd\u001d\ufffd\u0012<\ufffdv[Bu@\ufffd\ufffd\ufffd\ufffd+\ufffd\u0000-", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0001E[\u0007\fd\ufffd\ufffd\ufffd\b\u001e\ufffd-\ufffdR\ufffdN\ufffd!\u06a3\u07aa\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffd \ufffd'\n\ufffdM\ufffd1\u0005\ufffd\ufffd5\u0019<\ufffd\ufffd\ufffdb\ufffd\ufffd\u000e\ufffd\ufffdZ\ufffdFoV\u000eV\ufffdr8\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1f72b5a0f305e53a652bb0acfaf2c103ece05b19", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
05/06/2026 18:49:06 UTC	TCP	7681	—	Sonde port	Faible	Faible · 18
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Swissnet LLC", "service": null, "app_proto": null, "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 18, "tag_count": 0, "anomaly_count": 0, "campaign_key": "6f7ce84f60174a92bfe1651bd14c15aca9ac8da4", "event_fingerprint": "b4012aa34fdeb067d5b2ceee817c0957de66bab6", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-single-port" ], "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 7681 }, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6f1437eeddfbfa061e6200cf093bf4f6dcb983f8", "ban_policy": "advisory_monitor" }
05/06/2026 18:49:06 UTC	TCP	7681	http	SSRF	Élevée	Moyen · 59
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 24 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 951040:websocket-anomaly Cible HTTP GET /ws TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7681 Chemin / cible /ws Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /ws HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 websocket-anomaly Payload (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like G Requête brute (extrait) GET /ws HTTP/1.1 Host: 62.3.50.33:7681 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Cache-Control: no-cache Connection: Upgrade Origin: http://62.3.50.33:7681 Pragma: no-c Meta JSON brut { "http_header_count": 10, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "539ecdad151c9c9dc71f317e9e2fbae4aee81334", "http_host_hash": "6ffa2bf2355c4674df8d22606a6d4593716fe28e", "http_target_hash": "a70b33c6ff5b3c4ea91eaa80d93fee148b263f26", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 385, "payload_entropy": 5.477898970636688, "port_category": "registered", "org": "Swissnet LLC", "service": "http", "app_proto": "http", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 100, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 59, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c1dfa44de80450a0e270155b2bc324672e34c8ef", "event_fingerprint": "ff57c57e980bc994618a91417e90373bce9b27f1", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "df9c14bed57e6bde007625ceaa20e44f", "payload_hash": "6eb6e262f12a7cd41b43af2f144092bf", "path_pattern_hash": "0c65a812b078db6795486113db0a40a6" }, "target_context": { "dst_port": 7681, "service": "http" }, "payload_preview": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "evidence": { "method": "GET", "path": "\/ws", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "websocket-anomaly" ], "request_line": "GET \/ws HTTP\/1.1", "request_sample": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nCache-Control: no-cache\r\nConnection: Upgrade\r\nOrigin: http:\/\/62.3.50.33:7681\r\nPragma: no-c", "payload_snippet": "GET \/ws HTTP\/1.1\r\nHost: 62.3.50.33:7681\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like G", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "22907e46779c0a6cf3989e3a83ebe841d41209f4", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "951040:websocket-anomaly" ], "behavior_alert_count": 1, "behavior_priority": 96 }
05/06/2026 18:49:06 UTC	TCP	7681	tls	Sonde PostgreSQL	Moyenne	Faible · 17
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7681 Chemin / cible — Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��d9 h�l�?��͝Ѹ�y>`�T��G�6 �ؿ_�q�:��A��/��f�2�,@��+�/�,�0̨̩� �� [� Requête brute (extrait) ��d9 h�l�?��͝Ѹ�y>`�T��G�6 �ؿ_�q�:��A��/��f�2�,@��+�/�,�0̨̩� �� [ � � 2+3��9Z)��F@˒��˂6�穣4�D Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1479, "payload_entropy": 7.737027152781124, "port_category": "registered", "org": "Swissnet LLC", "service": "tls", "app_proto": "tls", "asn": 209373, "country": "AE", "dst_port": 7681, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 17, "tag_count": 2, "anomaly_count": 0, "campaign_key": "320ed113a415c7dd5551ed1be394e4e708d6a2b6", "event_fingerprint": "156c81feb5f7fae91e79390fc9fdd6280c3c333f", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "AE", "asn": 209373, "org": "Swissnet LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "2c6976d8264b78bbac0de8d83e2dcb89", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 7681, "service": "tls" }, "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdd9\th\ufffdl\ufffd?\ufffd\ufffd\ufffd\ufffd\u035d\u001a\u0478\ufffdy>`\ufffdT\ufffd\u0012\ufffdG\ufffd6 \ufffd\u063f\u001e_\ufffdq\u0019\ufffd:\ufffd\u0019\ufffdA\ufffd\u0018\u001b\ufffd\ufffd\u0015\/\ufffd\ufffd\ufffd\ufffdf\ufffd2\ufffd,@\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdd9\th\ufffdl\ufffd?\ufffd\ufffd\ufffd\ufffd\u035d\u001a\u0478\ufffdy>`\ufffdT\ufffd\u0012\ufffdG\ufffd6 \ufffd\u063f\u001e_\ufffdq\u0019\ufffd:\ufffd\u0019\ufffdA\ufffd\u0018\u001b\ufffd\ufffd\u0015\/\ufffd\ufffd\ufffd\ufffdf\ufffd2\ufffd,@\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\u008e\ufffd9Z)\ufffd\ufffd\ufffdF@\u02d2\u0002\ufffd\ufffd\u02c26\ufffd\u7a634\u0004\ufffdD", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdd9\th\ufffdl\ufffd?\ufffd\ufffd\ufffd\ufffd\u035d\u001a\u0478\ufffdy>`\ufffdT\ufffd\u0012\ufffdG\ufffd6 \ufffd\u063f\u001e_\ufffdq\u0019\ufffd:\ufffd\u0019\ufffdA\ufffd\u0018\u001b\ufffd\ufffd\u0015\/\ufffd\ufffd\ufffd\ufffdf\ufffd2\ufffd,@\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdd9\th\ufffdl\ufffd?\ufffd\ufffd\ufffd\ufffd\u035d\u001a\u0478\ufffdy>`\ufffdT\ufffd\u0012\ufffdG\ufffd6 \ufffd\u063f\u001e_\ufffdq\u0019\ufffd:\ufffd\u0019\ufffdA\ufffd\u0018\u001b\ufffd\ufffd\u0015\/\ufffd\ufffd\ufffd\ufffdf\ufffd2\ufffd,@\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\u008e\ufffd9Z)\ufffd\ufffd\ufffdF@\u02d2\u0002\ufffd\ufffd\u02c26\ufffd\u7a634\u0004\ufffdD", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdd9\t*h\ufffdl\ufffd?\ufffd\ufffd\ufffd\ufffd\u035d\u001a\u0478\ufffdy>`\ufffdT\ufffd\u0012\ufffdG\ufffd6 \ufffd\u063f\u001e_\ufffdq\u0019\ufffd:\ufffd\u0019\ufffdA\ufffd\u0018\u001b\ufffd\ufffd\u0015\/\ufffd\ufffd\ufffd\ufffdf\ufffd2\ufffd,@\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005[\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1a3c6b3cc726ece6af170566eb3442c583ba18d3", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
01/06/2026 04:49:09 UTC	TCP	7681	http	web attack	Élevée	Critique · 100
Étape — WAF 19 Recommandation — Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /ws TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7681 Chemin / cible /ws Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Meta JSON brut { "http_header_count": 10, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "539ecdad151c9c9dc71f317e9e2fbae4aee81334", "http_host_hash": "6ffa2bf2355c4674df8d22606a6d4593716fe28e", "http_target_hash": "a70b33c6ff5b3c4ea91eaa80d93fee148b263f26", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 385, "payload_entropy": 5.498478025012599, "port_category": "registered", "org": "Swissnet LLC", "service": "http", "app_proto": "http", "asn": 209373, "country": "AE", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "9686aaf7b68f75f4916353f42a4b6a33aa182d53", "event_fingerprint": "4dbaec68f787f383bcc1a2d6eb00c0d6fbeaea0e", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ] }
01/06/2026 04:49:09 UTC	TCP	7681	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
01/06/2026 04:49:08 UTC	TCP	7681	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1

31.56.209.218

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence