{"ip":"31.58.215.245","exported_at":"2026-10-13T05:31:38+00:00","period_days":1,"metrics":{"events7d":683,"distinct_ports":1,"distinct_classifications":3,"max_severity":5,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":45,"attack_stage":"probe","attack_chain_stage":"reconnaissance","threat_family":["cryptominer"],"recommended_action":"monitor","confidence":0.6,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":30,"novelty":0},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":683,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 45\/100","campaign_hint_fr":"Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)","confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":45,"correlation_boost":10},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["scan_coordonn\u00e9"],"correlation_flags_labels_fr":["Scan coordonn\u00e9"],"confidence_pct":60,"confidence_hint_fr":"Corr\u00e9lation +10","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0771"],"tags_summary":["pat-0771"],"attack_vector":"bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0004\ufffd*x\ufffd\u0011\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffdj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\/Satoshi:0.12.1\/\ufffd\ufffd\u000e\u0000\u0001","port":8333,"service":"bitcoin","service_label_fr":"BITCOIN"},"protocol_summary_fr":"Payload \ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\u0004\ufffd*x\ufffd\u0011\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffdj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u2026 \u00b7 BITCOIN:8333","evidence_snippet":"\ufffd\ufffd\ufffd\ufffdversionf\ufffd*x\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffd \ufffd\ufffd\ufffd \ufffd\/Satoshi:0.12.1\/\ufffd\ufffd","target_port_label":"8333 \u00b7 BITCOIN","emulator_service":"bitcoin","confidence_reason":"Confiance 50 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","classification_reason_label_fr":"Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_factors_fr":"Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10","payload_preview":"\ufffd\ufffd\ufffd\ufffdversionf\ufffd*x\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffd \ufffd\ufffd\ufffd \ufffd\/Satoshi:0.12.1\/\ufffd\ufffd","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"events":[{"id":777744,"ip":"31.58.215.245","ts":"2026-10-13 03:33:35.000000","proto":"tcp","src_port":9954,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 126, \u0022payload_entropy\u0022: 3.333646368006817, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d79b4a53dd1daa096d49aa57bebbff79\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\\u0004\ufffd*x\ufffd\\u0011\\u0001\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\ufffdj\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0010\/Satoshi:0.12.1\/\ufffd\ufffd\\u000e\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\\u0004\ufffd*x\ufffd\\u0011\\u0001\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\ufffdj\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0010\/Satoshi:0.12.1\/\ufffd\ufffd\\u000e\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\\u0004\ufffd*x\ufffd\\u0011\\u0001\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\ufffdj\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0010\/Satoshi:0.12.1\/\ufffd\ufffd\\u000e\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002240215fe7f83d210292083960e5fbe30e80014889\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\\u0004\ufffd*x\ufffd\\u0011\\u0001\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\ufffdj\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0010\/Satoshi:0.12.1\/\ufffd\ufffd\\u000e\\u0000\\u0001\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd*x\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffd \ufffd\ufffd\ufffd \ufffd\/Satoshi:0.12.1\/\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\\u0004\ufffd*x\ufffd\\u0011\\u0001\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\ufffdj\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0010\/Satoshi:0.12.1\/\ufffd\ufffd\\u000e\\u0000\\u0001\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd*x\ufffd\ufffd\ufffd\ufffdj\ufffd\ufffd \ufffd\ufffd\ufffd \ufffd\/Satoshi:0.12.1\/\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":126},{"id":777738,"ip":"31.58.215.245","ts":"2026-10-13 03:33:34.000000","proto":"tcp","src_port":22006,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228fce73f2a733cfeb2e042ebb364d133d\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u00009;A\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u00009;A\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u00009;A\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u00009;A\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u00009;A\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002224f5d1b6622cfebf21326b85ecfca5c9201fe7df\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u00009;A\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversiong9;A\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u00009;A\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversiong9;A\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777732,"ip":"31.58.215.245","ts":"2026-10-13 03:33:33.000000","proto":"tcp","src_port":34463,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228c33ae2a66ce233c57b6e1639cfa6bbf\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000u\\u0000\\u0000\\u0000\u070a6\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000u\\u0000\\u0000\\u0000\u070a6\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000u\\u0000\\u0000\\u0000\u070a6\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000u\\u0000\\u0000\\u0000\u070a6\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000u\\u0000\\u0000\\u0000\u070a6\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bb80d9d0087e80671dc8fb855808e9b070d90fcf\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000u\\u0000\\u0000\\u0000\u070a6\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionu\u070a6\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000u\\u0000\\u0000\\u0000\u070a6\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionu\u070a6\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777725,"ip":"31.58.215.245","ts":"2026-10-13 03:33:32.000000","proto":"tcp","src_port":55476,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222fe7d03507e09808ccf3ecf0ec1359cd\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\\u0006(\\n\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\\u0006(\\n\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\\u0006(\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\\u0006(\\n\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\\u0006(\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229159881241514fc3ab9b34a94edf0680b6a3082b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\\u0006(\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione\ufffd(\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\\u0006(\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione\ufffd(\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777720,"ip":"31.58.215.245","ts":"2026-10-13 03:33:30.000000","proto":"tcp","src_port":48980,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022e9fa2fb9a2608215f773903f7ede49f1\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\\u0012\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\\u0012\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\\u0012\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\\u0012\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\\u0012\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227416ce9bb46287aadbbefd274c7cc57e6299450b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\\u0012\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\\u0012\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777714,"ip":"31.58.215.245","ts":"2026-10-13 03:33:29.000000","proto":"tcp","src_port":30155,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224faabd22796d7c0670795f0f991d085a\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\/Y\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\/Y\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\/Y\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\/Y\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\/Y\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022eb98293f93ea8960708749469e34366d2da9c012\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\/Y\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\/Y\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\/Y\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\/Y\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777708,"ip":"31.58.215.245","ts":"2026-10-13 03:33:28.000000","proto":"tcp","src_port":52513,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002206811b5f12621d693ce8f0b5315d338c\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000W,\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000W,\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000W,\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000W,\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000W,\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b7da752e0c18c1c88fd02dd25aa0c5039574a512\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000W,\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioniW,\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000W,\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioniW,\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777703,"ip":"31.58.215.245","ts":"2026-10-13 03:33:27.000000","proto":"tcp","src_port":51690,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00227c87420da96df8a434c630e752857100\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\u0739\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\u0739\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\u0739\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\u0739\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\u0739\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225513388685e30f59788236181975a6f867939633\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\u0739\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\u0739\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\u0739\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\u0739\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777696,"ip":"31.58.215.245","ts":"2026-10-13 03:33:25.000000","proto":"tcp","src_port":3209,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228d2a8777c5a719ee9922dc355c42fb4c\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\u003E\ufffd\u0027\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\u003E\ufffd\u0027\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\u003E\ufffd\u0027\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\u003E\ufffd\u0027\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\u003E\ufffd\u0027\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228e40f683f81130b0d84f10f3994639c4417d2a45\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\u003E\ufffd\u0027\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversiong\u003E\ufffd\u0027\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\u003E\ufffd\u0027\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversiong\u003E\ufffd\u0027\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777690,"ip":"31.58.215.245","ts":"2026-10-13 03:33:24.000000","proto":"tcp","src_port":35148,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229f005bc4e89dd45e91df66e54cfc7a25\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000D\ufffdp\\u000b\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000D\ufffdp\\u000b\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000D\ufffdp\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000D\ufffdp\\u000b\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000D\ufffdp\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022026bed6132e13797e63a0c98eed3f46df400e730\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000D\ufffdp\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionfD\ufffdp\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000D\ufffdp\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionfD\ufffdp\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777684,"ip":"31.58.215.245","ts":"2026-10-13 03:33:23.000000","proto":"tcp","src_port":62117,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002261d72eed4d8f3110e9dad2e7a2f76a0b\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000\ufffd\ufffd\\bM\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000\ufffd\ufffd\\bM\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000\ufffd\ufffd\\bM\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000\ufffd\ufffd\\bM\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000\ufffd\ufffd\\bM\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226d02f73d55c79f6150982979f40267e816a4bb0a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000\ufffd\ufffd\\bM\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionj\ufffd\ufffdM\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000\ufffd\ufffd\\bM\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionj\ufffd\ufffdM\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777678,"ip":"31.58.215.245","ts":"2026-10-13 03:33:22.000000","proto":"tcp","src_port":43294,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222d1695333bf078a313ffff57ca26c45f\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffdE\ufffd~\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffdE\ufffd~\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffdE\ufffd~\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffdE\ufffd~\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffdE\ufffd~\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002216d8034eb815c86add15e1a7fb2b910c47dfddab\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffdE\ufffd~\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione\ufffdE\ufffd~\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffdE\ufffd~\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione\ufffdE\ufffd~\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777672,"ip":"31.58.215.245","ts":"2026-10-13 03:33:21.000000","proto":"tcp","src_port":31785,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002240b7cdf0c834cc3de9b367359b4ce1cf\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000!\ufffda\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000!\ufffda\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000!\ufffda\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000!\ufffda\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000!\ufffda\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002293e000a760d9bb311e2a166b2a1dc142b1d86b38\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000!\ufffda\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf!\ufffda\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000!\ufffda\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf!\ufffda\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777665,"ip":"31.58.215.245","ts":"2026-10-13 03:33:19.000000","proto":"tcp","src_port":48026,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f42fc3ec0c051195bd5464a9deecca2b\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u00006\u037c\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u00006\u037c\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u00006\u037c\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u00006\u037c\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u00006\u037c\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228e840a55315f19b815ead1dd56bfd9c3ab09761d\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u00006\u037c\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione6\u037c\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u00006\u037c\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione6\u037c\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777659,"ip":"31.58.215.245","ts":"2026-10-13 03:33:18.000000","proto":"tcp","src_port":39511,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d00d39656719cc26e4e8c8e19641057e\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdZ\\u0015j\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdZ\\u0015j\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdZ\\u0015j\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdZ\\u0015j\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdZ\\u0015j\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cab88d2e4c685712a7fec21ca72e98290152caae\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdZ\\u0015j\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionq\ufffdZj\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdZ\\u0015j\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionq\ufffdZj\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777653,"ip":"31.58.215.245","ts":"2026-10-13 03:33:17.000000","proto":"tcp","src_port":25875,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002283a7c6ba9d999192e8b4a07018d0a551\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\\u0014*O\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\\u0014*O\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\\u0014*O\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\\u0014*O\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\\u0014*O\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220418b69ef235ec868664236932a7050a245a0a20\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\\u0014*O\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioni\ufffd*O\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\\u0014*O\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioni\ufffd*O\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777643,"ip":"31.58.215.245","ts":"2026-10-13 03:33:16.000000","proto":"tcp","src_port":1674,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226704141287e33d5f8390beb5d714ed4c\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd4\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd4\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd4\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd4\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd4\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228e57829cff8dab4a0aad64d947d72c9ba8e5d8d7\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd4\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\ufffd4\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd4\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\ufffd4\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777637,"ip":"31.58.215.245","ts":"2026-10-13 03:33:15.000000","proto":"tcp","src_port":16396,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222382242f4895781cc79d402c973ab7cd\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000k\\u0000\\u0000\\u0000\ufffd\ufffdQ\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000k\\u0000\\u0000\\u0000\ufffd\ufffdQ\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000k\\u0000\\u0000\\u0000\ufffd\ufffdQ\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000k\\u0000\\u0000\\u0000\ufffd\ufffdQ\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000k\\u0000\\u0000\\u0000\ufffd\ufffdQ\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c06ccfddcb7ea9d3b0076e09291978b12a4526c6\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000k\\u0000\\u0000\\u0000\ufffd\ufffdQ\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionk\ufffd\ufffdQ\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000k\\u0000\\u0000\\u0000\ufffd\ufffdQ\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionk\ufffd\ufffdQ\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777631,"ip":"31.58.215.245","ts":"2026-10-13 03:33:13.000000","proto":"tcp","src_port":10066,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002238e7e794ef9918c67b2c6f3df174fc01\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\\u001f]\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\\u001f]\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\\u001f]\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\\u001f]\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\\u001f]\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002260cbc16232877baa8c6dcd245206f39ca3ca074b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\\u001f]\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd]\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\\u001f]\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd]\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777625,"ip":"31.58.215.245","ts":"2026-10-13 03:33:12.000000","proto":"tcp","src_port":2128,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022fe4c90ef2aef482dc56a6f40e8e57c41\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffdDz\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffdDz\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffdDz\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffdDz\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffdDz\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c20ba473ec769a2a2eef6985d0dfbd74abba128a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffdDz\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\ufffdDz\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffdDz\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\ufffdDz\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777619,"ip":"31.58.215.245","ts":"2026-10-13 03:33:11.000000","proto":"tcp","src_port":22323,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226274652c36b78ae93e8895b2790fa0ee\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdL\ufffdR\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdL\ufffdR\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdL\ufffdR\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdL\ufffdR\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdL\ufffdR\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002239498b0591a8eded1752d3aa7b1fc83cada0928b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdL\ufffdR\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionq\ufffdL\ufffdR\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdL\ufffdR\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionq\ufffdL\ufffdR\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777613,"ip":"31.58.215.245","ts":"2026-10-13 03:33:10.000000","proto":"tcp","src_port":48943,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022091096729960bb8bd513def57fb0eb15\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\\u0015\ufffd+\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\\u0015\ufffd+\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\\u0015\ufffd+\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\\u0015\ufffd+\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\\u0015\ufffd+\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e941bd9a5b5c9380cb6802b5b0cf27cd759b4cfd\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\\u0015\ufffd+\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioni\ufffd+\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\\u0015\ufffd+\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioni\ufffd+\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777607,"ip":"31.58.215.245","ts":"2026-10-13 03:33:09.000000","proto":"tcp","src_port":9216,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222c03ca579c479aad319694b949c4b46e\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffdo\\u0003\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffdo\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffdo\\u0003\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffdo\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffdo\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002271567e9397772bea123ad59a5c21bac4c2ba5ffc\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffdo\\u0003\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffdo\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffdo\\u0003\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffdo\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777601,"ip":"31.58.215.245","ts":"2026-10-13 03:33:07.000000","proto":"tcp","src_port":51266,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b5932f69cd64cc9b9bfe3f8b3f3096f6\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u00004\ufffdfu\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u00004\ufffdfu\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u00004\ufffdfu\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u00004\ufffdfu\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u00004\ufffdfu\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e0ae9bc777b06142f9da9f829297b18d0e661d6c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u00004\ufffdfu\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{4\ufffdfu\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u00004\ufffdfu\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{4\ufffdfu\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777593,"ip":"31.58.215.245","ts":"2026-10-13 03:33:06.000000","proto":"tcp","src_port":18814,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00220dd4cfc5ab90a9f61c986ce2d97ef87b\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000n\\u0000\\u0000\\u0000m\ufffd\ufffd.\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000n\\u0000\\u0000\\u0000m\ufffd\ufffd.\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000n\\u0000\\u0000\\u0000m\ufffd\ufffd.\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000n\\u0000\\u0000\\u0000m\ufffd\ufffd.\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000n\\u0000\\u0000\\u0000m\ufffd\ufffd.\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b9c1a5953ae4aaa8d49cf40e0c3f378f9dd79056\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000n\\u0000\\u0000\\u0000m\ufffd\ufffd.\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionnm\ufffd\ufffd.\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000n\\u0000\\u0000\\u0000m\ufffd\ufffd.\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionnm\ufffd\ufffd.\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777585,"ip":"31.58.215.245","ts":"2026-10-13 03:33:05.000000","proto":"tcp","src_port":3569,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 150, \u0022payload_entropy\u0022: 3.9696702538095603, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022488700fa8fd11a50fcb61fe9146c4d7e\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u00001\ufffd\ufffd\u00c0\\u0011\\u0001\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000n\ufffd\ufffdj\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\/Satoshi:0.14.2\/UASF-Se\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u00001\ufffd\ufffd\u00c0\\u0011\\u0001\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000n\ufffd\ufffdj\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\/Satoshi:0.14.2\/UASF-Segwit:0.3(BIP148)\/\ufffd\ufffd\\u000e\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u00001\ufffd\ufffd\u00c0\\u0011\\u0001\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000n\ufffd\ufffdj\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\/Satoshi:0.14.2\/UASF-Se\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002242f490a9c035655323de8d175629e8ecf9251fca\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u00001\ufffd\ufffd\u00c0\\u0011\\u0001\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000n\ufffd\ufffdj\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\/Satoshi:0.14.2\/UASF-Se\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion~1\ufffd\ufffd\u00c0n\ufffd\ufffdj\ufffd\ufffd \ufffd\ufffd\ufffd \ufffd(\/Satoshi:0.14.2\/UASF-Se\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u00001\ufffd\ufffd\u00c0\\u0011\\u0001\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000n\ufffd\ufffdj\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\ufffd\\u0000\\u0000\\u0001 \ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\/Satoshi:0.14.2\/UASF-Se\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion~1\ufffd\ufffd\u00c0n\ufffd\ufffdj\ufffd\ufffd \ufffd\ufffd\ufffd \ufffd(\/Satoshi:0.14.2\/UASF-Se\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 6, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":150},{"id":777581,"ip":"31.58.215.245","ts":"2026-10-13 03:32:59.000000","proto":"tcp","src_port":1336,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00223f4e3bbda045a16ffb337bf3a9f6f546\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\u07194\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\u07194\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\u07194\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\u07194\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\u07194\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002275f53a0196a82d321b104cd8c35c13a8100c7397\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\u07194\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioni\u07194\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\u07194\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioni\u07194\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777578,"ip":"31.58.215.245","ts":"2026-10-13 03:32:58.000000","proto":"tcp","src_port":49208,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c58bf4f9a88638ecd60127b57245e3f0\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000|.\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000|.\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000|.\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000|.\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000|.\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002229a812f8ee4b42b4b4af221ed18b40ee0870dd51\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000|.\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf|.\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000|.\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf|.\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777575,"ip":"31.58.215.245","ts":"2026-10-13 03:32:57.000000","proto":"tcp","src_port":5782,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c7a22b126091cf837c8bcb446725815a\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000k\uf7a2\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000k\uf7a2\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000k\uf7a2\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000k\uf7a2\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000k\uf7a2\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022488f54998e74a453bdfb6d10e4b1e68ec8ead2ba\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000k\uf7a2\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionek\uf7a2\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000k\uf7a2\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionek\uf7a2\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777572,"ip":"31.58.215.245","ts":"2026-10-13 03:32:55.000000","proto":"tcp","src_port":36591,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00227ec720e719a73582cad4c3c73d0bb626\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000B\\u0002\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000B\\u0002\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000B\\u0002\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000B\\u0002\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000B\\u0002\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c167492e9455b45b74595a65819de81560e598fe\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000B\\u0002\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioniB\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000B\\u0002\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioniB\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777569,"ip":"31.58.215.245","ts":"2026-10-13 03:32:54.000000","proto":"tcp","src_port":33779,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022cfdbaab6874d5590d3558e6596efa052\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffdZfs\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffdZfs\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffdZfs\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffdZfs\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffdZfs\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220f335795cb0833047a11f0e25bf0c46a190d6b32\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffdZfs\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\ufffdZfs\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffdZfs\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\ufffdZfs\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777564,"ip":"31.58.215.245","ts":"2026-10-13 03:32:53.000000","proto":"tcp","src_port":11431,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00223f69cf3c69b3007f9e7bc70571b5d820\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000Jvq\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000Jvq\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000Jvq\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000Jvq\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000Jvq\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d7ad8a8bb21fd85e581ce118643d2064de362e1c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000Jvq\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionfJvq\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000Jvq\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionfJvq\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777558,"ip":"31.58.215.245","ts":"2026-10-13 03:32:52.000000","proto":"tcp","src_port":46222,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00227b2d771121cba9041068ce23bbfe55dc\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000w\\u0000\\u0000\\u0000{EjH\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000w\\u0000\\u0000\\u0000{EjH\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000w\\u0000\\u0000\\u0000{EjH\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000w\\u0000\\u0000\\u0000{EjH\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000w\\u0000\\u0000\\u0000{EjH\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fe3845943d1309e311d069c78c7f5a54963841cf\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000w\\u0000\\u0000\\u0000{EjH\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionw{EjH\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000w\\u0000\\u0000\\u0000{EjH\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionw{EjH\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777551,"ip":"31.58.215.245","ts":"2026-10-13 03:32:51.000000","proto":"tcp","src_port":41985,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228325b7011ab024d610501c883afdde5a\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\u0712\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\u0712\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\u0712\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\u0712\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\u0712\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002215b680119782e8823f4d5c05cdb09cb29f99af4b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\u0712\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione\u0712\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\u0712\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione\u0712\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777545,"ip":"31.58.215.245","ts":"2026-10-13 03:32:49.000000","proto":"tcp","src_port":43315,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226e6f96534fb9dcacdd20a3642f0cc96c\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000\ufffd\ufffdH\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000\ufffd\ufffdH\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000\ufffd\ufffdH\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000\ufffd\ufffdH\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000\ufffd\ufffdH\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224156b5205f19b469bf56154ca8180dc37e602c78\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000\ufffd\ufffdH\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionj\ufffd\ufffdH\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000j\\u0000\\u0000\\u0000\ufffd\ufffdH\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionj\ufffd\ufffdH\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777539,"ip":"31.58.215.245","ts":"2026-10-13 03:32:48.000000","proto":"tcp","src_port":62074,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224f47c6b5d94450cfbd84f3380ee2c08c\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u0000Y\ufffd\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u0000Y\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u0000Y\ufffd\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u0000Y\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u0000Y\ufffd\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ffde09134929954aa6eb4376e129c3ec691e68b6\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u0000Y\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion~Y\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000~\\u0000\\u0000\\u0000Y\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion~Y\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777533,"ip":"31.58.215.245","ts":"2026-10-13 03:32:47.000000","proto":"tcp","src_port":24177,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022395845f7d6dc88d364623b7f97c96746\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\t\ufffd\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\t\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\t\ufffd\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\t\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\t\ufffd\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223e555c1c6c4efe60e6549a6aa31841138c4ed154\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\t\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\\t\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\t\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\\t\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777526,"ip":"31.58.215.245","ts":"2026-10-13 03:32:46.000000","proto":"tcp","src_port":35394,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002225f7e3eeb4496cc97c14f44987403d1e\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000L5\ufffd\\t\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000L5\ufffd\\t\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000L5\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000L5\ufffd\\t\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000L5\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fd7962cf19dd9722bc16661729307fff4a4d9d48\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000L5\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{L5\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000L5\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{L5\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777520,"ip":"31.58.215.245","ts":"2026-10-13 03:32:45.000000","proto":"tcp","src_port":15074,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222f6dff3165c608f76e041a9b78af8a12\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0007c\ufffdM\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0007c\ufffdM\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0007c\ufffdM\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0007c\ufffdM\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0007c\ufffdM\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002280be6cc409a2021ba17b63bcf23f5e65467b7e65\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0007c\ufffdM\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{c\ufffdM\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0007c\ufffdM\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{c\ufffdM\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777514,"ip":"31.58.215.245","ts":"2026-10-13 03:32:43.000000","proto":"tcp","src_port":10001,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222d5f40c4784c073271c40517cea7e2b1\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffdY\\u0004\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffdY\\u0004\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffdY\\u0004\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffdY\\u0004\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffdY\\u0004\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221abdce8c2d80f14b88018b4e06cce3d1a47a266a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffdY\\u0004\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffdY\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffdY\\u0004\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffdY\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777507,"ip":"31.58.215.245","ts":"2026-10-13 03:32:42.000000","proto":"tcp","src_port":21686,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f36d50a31b63461e28be2b268dfefa2a\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000:\ufffdLK\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000:\ufffdLK\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000:\ufffdLK\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000:\ufffdLK\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000:\ufffdLK\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022de4bc1e6435d940e23f7cd5b148e2e19ac582b0b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000:\ufffdLK\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf:\ufffdLK\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000:\ufffdLK\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf:\ufffdLK\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777501,"ip":"31.58.215.245","ts":"2026-10-13 03:32:41.000000","proto":"tcp","src_port":22207,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229f54920fa0274ca0ac1b84ef31a0600c\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\ufffdd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\ufffdd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\ufffdd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\ufffdd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\ufffdd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224d1861aef79da0f9fcfdeee54a7041060171e8c2\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\ufffdd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversiong\ufffd\ufffd\ufffdd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\ufffdd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversiong\ufffd\ufffd\ufffdd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777495,"ip":"31.58.215.245","ts":"2026-10-13 03:32:40.000000","proto":"tcp","src_port":6488,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224b41e0c86d96dc60e0de4aebc5fc907b\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdPO\\r\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdPO\\r\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdPO\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdPO\\r\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdPO\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b0e5c9d50f9fa8fa1ec9d440457ca5ffa869d6ab\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdPO\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionq\ufffdPO\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffdPO\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionq\ufffdPO\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777489,"ip":"31.58.215.245","ts":"2026-10-13 03:32:38.000000","proto":"tcp","src_port":38633,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a9e989da27777f659e11c94bfbc08576\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\\\u0022\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\\\u0022\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\\\u0022\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\\\u0022\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\\\u0022\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a81a2fc5103eb82e0e0c3aa1fa46b0a5ce8f102e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\\\u0022\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione\ufffd\\\u0022\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffd\\\u0022\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione\ufffd\\\u0022\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777483,"ip":"31.58.215.245","ts":"2026-10-13 03:32:37.000000","proto":"tcp","src_port":54701,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224bc053eeafdbb515ab13c1aa48b15b76\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000l\\u001bbW\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000l\\u001bbW\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000l\\u001bbW\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000l\\u001bbW\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000l\\u001bbW\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002238dd787ab0fc17509c1416358a5cefc7d1166704\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000l\\u001bbW\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionqlbW\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000l\\u001bbW\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionqlbW\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777477,"ip":"31.58.215.245","ts":"2026-10-13 03:32:36.000000","proto":"tcp","src_port":6613,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d310b163e84370c70f691603ef8d5617\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c19b48df7ec11cefab7a68cbf0482da0f398fc4b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777471,"ip":"31.58.215.245","ts":"2026-10-13 03:32:35.000000","proto":"tcp","src_port":13629,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022742994f10a24a3395a0979ccdc21b244\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000w\\u0000\\u0000\\u0000\ufffd\\u001eD\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000w\\u0000\\u0000\\u0000\ufffd\\u001eD\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000w\\u0000\\u0000\\u0000\ufffd\\u001eD\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000w\\u0000\\u0000\\u0000\ufffd\\u001eD\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000w\\u0000\\u0000\\u0000\ufffd\\u001eD\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224afd58b8903efb920d5f35c85285d1ef8cc6ef9b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000w\\u0000\\u0000\\u0000\ufffd\\u001eD\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionw\ufffdD\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000w\\u0000\\u0000\\u0000\ufffd\\u001eD\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionw\ufffdD\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777464,"ip":"31.58.215.245","ts":"2026-10-13 03:32:34.000000","proto":"tcp","src_port":53595,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002259f5f26d3aaf9801a365ed211c8a66ab\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0007O7\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0007O7\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0007O7\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0007O7\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0007O7\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fdbae8c0ec45393d7f8b8337115ac66a5c1b9070\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0007O7\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{O7\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0007O7\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{O7\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777460,"ip":"31.58.215.245","ts":"2026-10-13 03:32:32.000000","proto":"tcp","src_port":56370,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022be9f0e5ca33e02153fce60333c31ab08\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\u06c3\u07c0\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\u06c3\u07c0\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\u06c3\u07c0\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\u06c3\u07c0\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\u06c3\u07c0\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002283b57d33cd683563036807c6827372d873e4adf7\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\u06c3\u07c0\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione\u06c3\u07c0\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\u06c3\u07c0\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione\u06c3\u07c0\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":777453,"ip":"31.58.215.245","ts":"2026-10-13 03:32:31.000000","proto":"tcp","src_port":9238,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d2bbe141c33236470f74271f0dc19194\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\u05e2\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\u05e2\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\u05e2\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\u05e2\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\u05e2\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e1ff850155c9767d34ad5a73b09f5a02a63bbdd9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\u05e2\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversiong\ufffd\ufffd\u05e2\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000\ufffd\ufffd\u05e2\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversiong\ufffd\ufffd\u05e2\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (31.58.215.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002231.58.215.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24}],"total_events":475}