{"ip":"31.58.215.1","exported_at":"2026-10-14T04:50:40+00:00","period_days":1,"metrics":{"events7d":1195,"distinct_ports":1,"distinct_classifications":4,"max_severity":5,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":45,"attack_stage":"probe","attack_chain_stage":"reconnaissance","threat_family":["cryptominer"],"recommended_action":"monitor","confidence":0.6,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":30,"novelty":0},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":1195,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 45\/100","campaign_hint_fr":"Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)","confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":45,"correlation_boost":10},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["scan_coordonn\u00e9"],"correlation_flags_labels_fr":["Scan coordonn\u00e9"],"confidence_pct":60,"confidence_hint_fr":"Corr\u00e9lation +10","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0554"],"tags_summary":["pat-0554"],"attack_vector":"bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0014g(\ufffd","port":8333,"service":"bitcoin","service_label_fr":"BITCOIN"},"protocol_summary_fr":"Payload \ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0014g(\ufffd \u00b7 BITCOIN:8333","evidence_snippet":"\ufffd\ufffd\ufffd\ufffdversion{g(\ufffd","target_port_label":"8333 \u00b7 BITCOIN","emulator_service":"bitcoin","confidence_reason":"Confiance 50 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","classification_reason_label_fr":"Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_factors_fr":"Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10","payload_preview":"\ufffd\ufffd\ufffd\ufffdversion{g(\ufffd","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"1.215.58.31.dnsbl.blacklistip.com","listed":true,"available":true,"response":"127.0.0.3","meaning":"Sonde ou scan","label":"Sonde Bitcoin"},"events":[{"id":1269238,"ip":"31.58.215.1","ts":"2026-10-14 02:20:07.000000","proto":"tcp","src_port":28858,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224b2822e868f282cf2f1f3da49aa83eac\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0014g(\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0014g(\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0014g(\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0014g(\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0014g(\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002287e1468ae22b7416ffd30902093ca0641a9a7381\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0014g(\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{g(\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0014g(\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{g(\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269231,"ip":"31.58.215.1","ts":"2026-10-14 02:20:05.000000","proto":"tcp","src_port":24776,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022376ecea179fdeb47e61074b25e0b08a2\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u0027\u0027t\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u0027\u0027t\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u0027\u0027t\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u0027\u0027t\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u0027\u0027t\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022da7f55cd67928cc99b3f6b35da600d67dd57d288\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u0027\u0027t\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\u0027\u0027t\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u0027\u0027t\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\u0027\u0027t\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269225,"ip":"31.58.215.1","ts":"2026-10-14 02:20:04.000000","proto":"tcp","src_port":3939,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022611ee9ae7080a4d5c55358f2624548d9\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffd\\u000bp\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffd\\u000bp\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffd\\u000bp\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffd\\u000bp\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffd\\u000bp\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225976e85726dbb03dc1c939e608529e362dd8451d\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffd\\u000bp\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionq\ufffdp\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffd\\u000bp\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionq\ufffdp\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269219,"ip":"31.58.215.1","ts":"2026-10-14 02:20:03.000000","proto":"tcp","src_port":61548,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022eef4dfa9aa1838ed8c182e54f9f07f3e\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000S\\u0013t6\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000S\\u0013t6\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000S\\u0013t6\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000S\\u0013t6\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000S\\u0013t6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002271b43ec4e8089d3c187be89c4611e97d4a579e0a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000S\\u0013t6\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionfSt6\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000S\\u0013t6\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionfSt6\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269213,"ip":"31.58.215.1","ts":"2026-10-14 02:20:02.000000","proto":"tcp","src_port":42943,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002262eaf0581933ec6ba389479ce383e58e\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\\u0013\u03f6\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\\u0013\u03f6\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\\u0013\u03f6\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\\u0013\u03f6\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\\u0013\u03f6\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228aa52e30a548640a3f27b070cbb98a19f5983dc5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\\u0013\u03f6\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\u03f6\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\\u0013\u03f6\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\u03f6\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269207,"ip":"31.58.215.1","ts":"2026-10-14 02:20:01.000000","proto":"tcp","src_port":26157,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228d44461916c6d05e701ae1588e8318b9\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000z-\ufffdr\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000z-\ufffdr\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000z-\ufffdr\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000z-\ufffdr\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000z-\ufffdr\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022aa965bad9433f86ddd73876b4265d2d86c80cf8e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000z-\ufffdr\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionjz-\ufffdr\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000z-\ufffdr\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionjz-\ufffdr\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269201,"ip":"31.58.215.1","ts":"2026-10-14 02:19:59.000000","proto":"tcp","src_port":63911,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00220c1d85092d2bb7b5bf0435e0fa9259e4\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000E\\u0019[\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000E\\u0019[\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000E\\u0019[\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000E\\u0019[\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000E\\u0019[\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227ba8e47edf4abc50f17ac3a7679fbb4cd3141957\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000E\\u0019[\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionfE[\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000E\\u0019[\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionfE[\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269195,"ip":"31.58.215.1","ts":"2026-10-14 02:19:58.000000","proto":"tcp","src_port":12370,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022276bf39333ed0fdf9c2abe96d393a71a\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000,K\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000,K\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000,K\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000,K\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000,K\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d4202e4ccb4a8182f2cea2d23d2b9276a82578eb\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000,K\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{,K\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000,K\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{,K\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269189,"ip":"31.58.215.1","ts":"2026-10-14 02:19:57.000000","proto":"tcp","src_port":17869,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022098f02d3d37b7c6072e542f5d520ee94\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000OC\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000OC\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000OC\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000OC\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000OC\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224e9ecab3fd5ec225f1180d4ac07f0d46a15f8e0c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000OC\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionfOC\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000OC\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionfOC\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269183,"ip":"31.58.215.1","ts":"2026-10-14 02:19:56.000000","proto":"tcp","src_port":43039,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002224390e224df93f644dfe86f2f88706b9\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u0289\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u0289\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u0289\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u0289\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u0289\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b328aa926d8427fb1f1666dd4cdb3957102074bc\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u0289\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\u0289\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u0289\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\u0289\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269178,"ip":"31.58.215.1","ts":"2026-10-14 02:19:55.000000","proto":"tcp","src_port":37271,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f2ed1ba790a4b6cfa4ab8eb3a224b77c\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\\u0004[\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\\u0004[\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\\u0004[\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\\u0004[\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\\u0004[\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022747c504284996160148d8d25bd1475ef191a2d44\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\\u0004[\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversiong\ufffd\ufffd[\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\\u0004[\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversiong\ufffd\ufffd[\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269171,"ip":"31.58.215.1","ts":"2026-10-14 02:19:53.000000","proto":"tcp","src_port":36575,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d37cfb0349e10f47e7c2ad30e5f428a0\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u0000u\ufffd\\u0004\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u0000u\ufffd\\u0004\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u0000u\ufffd\\u0004\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u0000u\ufffd\\u0004\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u0000u\ufffd\\u0004\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cd25f6bfd71868f9fa2fcdf4b44b6b2eb244cf46\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u0000u\ufffd\\u0004\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion~u\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u0000u\ufffd\\u0004\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion~u\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269164,"ip":"31.58.215.1","ts":"2026-10-14 02:19:52.000000","proto":"tcp","src_port":30243,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022997b0686a047cc8d3fc659a5abc39f12\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0016\ufffd\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0016\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0016\ufffd\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0016\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0016\ufffd\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e1925afd2339ac9b60766a258e62b05f96d2308c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0016\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0016\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269159,"ip":"31.58.215.1","ts":"2026-10-14 02:19:51.000000","proto":"tcp","src_port":60750,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022de9264e27227d034e81f61a12415309b\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000c\ufffd~(\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000c\ufffd~(\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000c\ufffd~(\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000c\ufffd~(\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000c\ufffd~(\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224daefe5e3cbdc9dca08b31abd98a401bb321ed9c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000c\ufffd~(\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionfc\ufffd~(\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000c\ufffd~(\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionfc\ufffd~(\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269153,"ip":"31.58.215.1","ts":"2026-10-14 02:19:50.000000","proto":"tcp","src_port":38465,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022bfbd82fad38b9209e8594ac736298860\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd10y\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd10y\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd10y\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd10y\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd10y\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221344b1f5105380fd354bef22af861fa374934c79\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd10y\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd10y\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd10y\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd10y\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269147,"ip":"31.58.215.1","ts":"2026-10-14 02:19:49.000000","proto":"tcp","src_port":38984,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a5e91c9417d32bd5bec740b6419c56d5\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000IL\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000IL\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000IL\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000IL\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000IL\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a28e5de15c82809a77c30fbe03b4013291dfbc97\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000IL\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{IL\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000IL\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{IL\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269139,"ip":"31.58.215.1","ts":"2026-10-14 02:19:47.000000","proto":"tcp","src_port":55188,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d6a94dec1cfb377a24fe89905e100847\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u0543\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u0543\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u0543\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u0543\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u0543\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224b53e3db668aac2a0e7c6811a763ff80d7933be3\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u0543\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\u0543\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u0543\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\u0543\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269132,"ip":"31.58.215.1","ts":"2026-10-14 02:19:46.000000","proto":"tcp","src_port":28378,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224dfe1e045c40488ead71a9567b04d65e\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffdt\\u001e\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffdt\\u001e\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffdt\\u001e\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffdt\\u001e\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffdt\\u001e\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222b3ddf0c7c2566b0c8ef71318167721f4f202174\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffdt\\u001e\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversiong\ufffdt\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffdt\\u001e\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversiong\ufffdt\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269125,"ip":"31.58.215.1","ts":"2026-10-14 02:19:45.000000","proto":"tcp","src_port":8515,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022e8066dbe68c4ab819238a69128fb734b\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\uc212~\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\uc212~\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\uc212~\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\uc212~\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\uc212~\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c115347a1051dd4640714f02347a87fa6968a4b9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\uc212~\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioni\uc212~\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\uc212~\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioni\uc212~\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269119,"ip":"31.58.215.1","ts":"2026-10-14 02:19:44.000000","proto":"tcp","src_port":36877,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002283ba867edf13d90140d22717f6e79254\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\u003C\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\u003C\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\u003C\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\u003C\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\u003C\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022960bdd39d22c2a5c4dd8c644f43a4bace92be337\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\u003C\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione\ufffd\u003C\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\u003C\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione\ufffd\u003C\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269113,"ip":"31.58.215.1","ts":"2026-10-14 02:19:42.000000","proto":"tcp","src_port":13512,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c4546ca9bf5cafa4bcf5d8233c0cdf76\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000H\ufffd\ufffd\\u001d\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000H\ufffd\ufffd\\u001d\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000H\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000H\ufffd\ufffd\\u001d\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000H\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e6141f02bfab95e1fb3e4fa2496d8d82f58e5725\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000H\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioniH\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000H\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioniH\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269106,"ip":"31.58.215.1","ts":"2026-10-14 02:19:41.000000","proto":"tcp","src_port":22378,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002287bcd2c3496741821194eb153f506297\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u000e\u00d5\\u000f\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u000e\u00d5\\u000f\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u000e\u00d5\\u000f\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u000e\u00d5\\u000f\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u000e\u00d5\\u000f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f1be175be0d6cda8cc5cd69c03461ec692932e3e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u000e\u00d5\\u000f\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\u00d5\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u000e\u00d5\\u000f\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\u00d5\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269099,"ip":"31.58.215.1","ts":"2026-10-14 02:19:40.000000","proto":"tcp","src_port":17781,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022fa2428d57c48ef461c323795e8d9a71d\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\ufffd\\u000eo}\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\ufffd\\u000eo}\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\ufffd\\u000eo}\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\ufffd\\u000eo}\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\ufffd\\u000eo}\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221bcf134ff33e985dc742c4328199917c6970f72a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\ufffd\\u000eo}\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionh\ufffdo}\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\ufffd\\u000eo}\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionh\ufffdo}\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269092,"ip":"31.58.215.1","ts":"2026-10-14 02:19:39.000000","proto":"tcp","src_port":42843,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a83f2adecabd923660de93b00e99f35f\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000z\\u0000\\u0000\\u0000\ufffd\ufffdR\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000z\\u0000\\u0000\\u0000\ufffd\ufffdR\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000z\\u0000\\u0000\\u0000\ufffd\ufffdR\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000z\\u0000\\u0000\\u0000\ufffd\ufffdR\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000z\\u0000\\u0000\\u0000\ufffd\ufffdR\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022342375b52a3ce7dba33c7ef33939832abcc0b61e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000z\\u0000\\u0000\\u0000\ufffd\ufffdR\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionz\ufffd\ufffdR\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000z\\u0000\\u0000\\u0000\ufffd\ufffdR\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionz\ufffd\ufffdR\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1269086,"ip":"31.58.215.1","ts":"2026-10-14 02:19:38.000000","proto":"tcp","src_port":3752,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224e53083854e94f6ada93db931708bb60\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u0027\ufffd\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u0027\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u0027\ufffd\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u0027\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u0027\ufffd\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223d8cc5edf114cb07a7cac09d35b440c9759ab40e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u0027\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\u0027\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u0027\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\u0027\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24}],"total_events":469}