Fiche IP

Belgique

34.156.225.10

Activité suspecte · risque 34/100

FAI Google LLC Première vue 12/10/2026 10:26 UTC Dernière vue 31/10/2026 23:28 UTC Risque Moyen

Période 2026-10-02 → 2026-11-01

Moyen 48/100

24h 7j 30j 90j

Synthèse

Score de risque max. 48/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 12/10/2026 10:26 UTC

Dernière observation 31/10/2026 23:28 UTC

Événements (période) 399

Décision conseillée Surveiller Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal TA0007 372 occurrences

Pourquoi listée

Type « Sonde NFS » (signaux protocolaires) · confiance 0%

Confiance 0 % — 6 signal(aux) capteur

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

48/100 Confiance 0 % 399 événements TA0007

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 34.156.225.10
Décision : Investiguer
Score max : 48/100 (Moyen)
Confiance : 0 %
Période : 2026-10-02 → 2026-11-01 · 399 événements
Motif : Type « Sonde NFS » (signaux protocolaires) · confiance 0%
MITRE : TA0007
FAI : Google LLC · Belgique

Comparaison ASN / FAI

ASN 396982 · 34.156.128.0/17 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 399 événements sur la période pour cette IP.

35.210.97.115 Tentative d'exploit 01/11/2026 14:49 UTC
35.210.204.44 SSRF 01/11/2026 14:38 UTC
35.206.178.11 Tentative d'exploit 01/11/2026 12:15 UTC
35.210.113.154 Tentative d'exploit 01/11/2026 12:15 UTC
216.180.246.163 SSRF 01/11/2026 12:05 UTC
216.180.246.2 SSRF 01/11/2026 10:25 UTC
35.210.238.60 Tentative d'exploit 01/11/2026 10:01 UTC
216.180.246.193 SSRF 01/11/2026 09:27 UTC

Événements (filtres)

399

Première observation

12/10/2026 10:26 UTC

Dernière observation

31/10/2026 23:28 UTC

Dernière activité (filtres)

31/10/2026 23:28 UTC

Événements 7j

155

Ports distincts (7j)

146

Classifications (7j)

144

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 382 FTP TCP 4 RSYNC TCP 2 ETCD TCP 1 I2P TCP 1 QUIC HTTP3 STUB TCP 1 ELASTICSEARCH TRANSPORT ALT TCP 1 SMB TCP 1 K8S API TCP 1 HDFS NAMENODE TCP 1 UNREAL GAME TCP 1 MYSQL TCP 1 NFS TCP 1 COUCHDB TCP 1

HTTP

382

FTP

RSYNC

ETCD

I2P

QUIC HTTP3 STUB

Géolocalisation

Origine réseau déclarée

Belgique unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Google LLC 0 Port 21 Sonde FTP (21/TCP)

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

nfs probe · via NFS:2049 · (sonde / probe)

Détails protocole

Aperçu payload

�(�B`��M�I

Port / service

2049 · NFS

Service émulé

NFS

Raison confiance

Confiance 0 % — 6 signal(aux) capteur

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Confiance

0% Confiance non établie

Famille de menace

scanner IP signalée (IPsum, 3 listes ou plus)

MITRE ATT&CK — tactiques observées

Découverte Accès initial

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

399 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

399 événement(s) — page 6/16

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
28/10/2026 06:09:17 UTC	TCP	6363 · HTTP	http	Sonde port 6363/TCP port 6363 tcp · via HTTP:6363 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6363 Chemin / cible / Preuve honeypot — Sonde port 6363/TCP Connexion détectée sur le port 6363 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 6363/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6363 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6363 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"0918c21bb05d1be3c258b6d1b83e4dae58feb6f5","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.0870381078604145,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":6363,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":2.7,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"71cd481ddbc4e358f918efdad929e991225f9591","event_fingerprint":"aadb0670960ee277b4e0a2462aa0a12769b678f0","classification_reason":"Type \u00ab port_6363_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"G…
28/10/2026 05:59:00 UTC	TCP	7084 · HTTP	http	Sonde port 7084/TCP port 7084 tcp · via HTTP:7084 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7084 Chemin / cible / Preuve honeypot — Sonde port 7084/TCP Connexion détectée sur le port 7084 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 7084/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7084 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7084 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"d72a9140b2e01b5444876d2b4a6339c0ac57e23d","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.143645385302128,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":7084,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":4,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"960ccae6f61e30aecd24da6cbd3ea658740e5122","event_fingerprint":"c533f9f37a2b7a96f148d08a3742028bc13f7a90","classification_reason":"Type \u00ab port_7084_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Goog…
28/10/2026 05:58:42 UTC	TCP	6664 · HTTP	http	Sonde IRC (6664/TCP) port 6664 tcp · via HTTP:6664 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6664 Chemin / cible / Preuve honeypot — Sonde IRC (6664/TCP) Connexion détectée sur le port 6664 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde IRC (6664/TCP) » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6664 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6664 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"f981e90e2543370348dadec9d1f02ddaa2d58458","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.1025494948911705,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":6664,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":6.2,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"e9c6b5bb56fa984ab1b5aada14bba9d2502f6ddf","event_fingerprint":"9042ffd3b85f302c4ab5cd53bea5ce4cedd80b19","classification_reason":"Type \u00ab port_6664_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"G…
28/10/2026 05:40:50 UTC	TCP	9089 · HTTP	http	Sonde port 9089/TCP port 9089 tcp · via HTTP:9089 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9089 Chemin / cible / Preuve honeypot — Sonde port 9089/TCP Connexion détectée sur le port 9089 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 9089/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9089 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9089 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"a4f4c32f839fa4e6f9c0f4573477ff45a4d62e5e","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.143645385302128,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":9089,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":2.4,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"f6e6ab21b9696a59b3fc92f42ec287d4e8d73b8e","event_fingerprint":"ab5218da624d7e5f5bee423485da4c6c0ddf9ae7","classification_reason":"Type \u00ab port_9089_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
28/10/2026 05:37:54 UTC	TCP	8593 · HTTP	http	Sonde port 8593/TCP port 8593 tcp · via HTTP:8593 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8593 Chemin / cible / Preuve honeypot — Sonde port 8593/TCP Connexion détectée sur le port 8593 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 8593/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8593 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8593 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"2935da9cc0d29194c2f9bb855aca8fa9dd2c16f2","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.132620450545713,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8593,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":2.4,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"d632eb6353fafd8998f2d063e75f90e13d9c9a5b","event_fingerprint":"c54e6e66b42958aff275b387b3a91ed2dc3ae840","classification_reason":"Type \u00ab port_8593_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
28/10/2026 05:18:29 UTC	TCP	3183 · HTTP	http	Sonde port 3183/TCP port 3183 tcp · via HTTP:3183 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3183 Chemin / cible / Preuve honeypot — Sonde port 3183/TCP Connexion détectée sur le port 3183 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 3183/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3183 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3183 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"06a10267a69be2e5133ce2450d99e61d4cb77ea3","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.1007367379974005,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":3183,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":4.8,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"3be4ab5a84c3f4a44d8c69bbdd860f4c81dae873","event_fingerprint":"733e17d9d666b1672a2cee26850c3b2d96565ff1","classification_reason":"Type \u00ab port_3183_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"G…
28/10/2026 04:57:05 UTC	TCP	2225 · HTTP	http	Sonde port 2225/TCP port 2225 tcp · via HTTP:2225 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2225 Chemin / cible / Preuve honeypot — Sonde port 2225/TCP Connexion détectée sur le port 2225 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 2225/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2225 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2225 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"980bf409a71c6d3a7982532f5cbf5394a23a234d","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.0836804024105975,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":2225,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":5.2,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"95452507c1e6ac89279ff594c5cb6c1e1f98ee3e","event_fingerprint":"eca50fe08b71328e16b7c59267d58e524a3c00b2","classification_reason":"Type \u00ab port_2225_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"G…
28/10/2026 04:57:03 UTC	TCP	8162 · HTTP	http	Sonde port 8162/TCP port 8162 tcp · via HTTP:8162 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8162 Chemin / cible / Preuve honeypot — Sonde port 8162/TCP Connexion détectée sur le port 8162 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 8162/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8162 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8162 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"0da0a03b93b2bda27142d9195b482bdad1e10689","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.116248125028156,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8162,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":2.8,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"1a5ab07c308d16f48551b4a2bf32305c31e858cc","event_fingerprint":"f6a82f2346b6ba241684fa46356cc1638bcfe4bd","classification_reason":"Type \u00ab port_8162_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
28/10/2026 04:49:41 UTC	TCP	5240 · HTTP	http	Sonde port 5240/TCP port 5240 tcp · via HTTP:5240 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5240 Chemin / cible / Preuve honeypot — Sonde port 5240/TCP Connexion détectée sur le port 5240 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 5240/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5240 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5240 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"530e7ab2f1d51db2194e408fa09103e0a8294f9f","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.107719957234756,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":5240,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":1.6,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"027588fe216abb5c8d112ae364a82cab2d0e23d2","event_fingerprint":"532704e063ca58f6e24b05c2fc648da1a6df6d96","classification_reason":"Type \u00ab port_5240_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
28/10/2026 04:45:56 UTC	TCP	19000 · HTTP	http	Sonde port 19000/TCP port 19000 tcp · via HTTP:19000 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 19000 Chemin / cible / Preuve honeypot — Sonde port 19000/TCP Connexion détectée sur le port 19000 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 19000/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:19000 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connect Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:19000 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"c22e863873e2289dccf99007d8922e9e1d2a1151","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":147,"payload_entropy":5.121461141812314,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":19000,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":5.9,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"bc78670ad3a352d8547f26df1d70d4dc1fabc3b0","event_fingerprint":"937507b113c4f47174d2eaace174e43cc6d63273","classification_reason":"Type \u00ab port_19000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"…
28/10/2026 04:45:42 UTC	TCP	8171 · HTTP	http	Sonde port 8171/TCP port 8171 tcp · via HTTP:8171 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8171 Chemin / cible / Preuve honeypot — Sonde port 8171/TCP Connexion détectée sur le port 8171 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 8171/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8171 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8171 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"c438cc28ac16d63eaa2360607761a776cf5482bb","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.129946755165142,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8171,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":4.3,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"282396481f73be8dd94d1fc4ba0f58ab54dc93c8","event_fingerprint":"08ccc5738240e8f30e2b8c7f1fbced51773a6c3b","classification_reason":"Type \u00ab port_8171_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
28/10/2026 04:33:06 UTC	TCP	12370 · HTTP	http	Sonde port 12370/TCP port 12370 tcp · via HTTP:12370 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12370 Chemin / cible / Preuve honeypot — Sonde port 12370/TCP Connexion détectée sur le port 12370 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 12370/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12370 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connect Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12370 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"e1473f1a87f4a5b60e93398829bec08ac2b60fb3","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":147,"payload_entropy":5.1156464957424275,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":12370,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":1.6,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"0da7a22971cf81c279d0fb2766cd8d67d388d6f3","event_fingerprint":"6bf1579de86510b5b261dc3d126fabde75ed79fc","classification_reason":"Type \u00ab port_12370_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":…
28/10/2026 04:24:04 UTC	TCP	7779 · UNREAL GAME	unreal-game	Sonde serveur de jeu game server probe · via UNREAL GAME:7779 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Émulateur UNREAL-GAME WAF — Recommandation Surveiller Tags http_get_probe net_game_server_probe unreal_game_emulated unreal_game_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7779 Chemin / cible — Service UNREAL GAME Payload GET / HTTP/1.1 Host: 62.3.50.33:7779 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Pourquoi cette classification : Type « Sonde serveur de jeu » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 24 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7779 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7779 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"protocol_emulated":true,"emulator_response":"ffffffff54536f7572636520456e67696e6520517565727900","emulator_response_len":25,"bytes_in":146,"payload_entropy":5.138474922958543,"port_category":"registered","org":"Google LLC","service":"unreal-game","app_proto":"unreal-game","asn":396982,"country":"BE","dst_port":7779,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":40,"risk_protocol":40,"risk_novelty":15,"risk_boost":0,"risk_granularity":6,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":40,"novelty":15},"risk_score":24,"tag_count":4,"anomaly_count":0,"campaign_key":"d5cabb722bb82da57711c987219810a7691ff958","event_fingerprint":"3db229151e00b19a83f1c30b3e6257fcccc11e13","classification_reason":"Type \u00ab game_server_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":40,"novelty":15,"risk_score":24,"correlation_boost":8},"named_classification_skipped":false,"service_name":"unreal-game","risk_confidence_factor":0,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Google LLC","is_datacenter":true,"is_tor_hint":false},"fingerprint":{"payload_hash":"1dafceb94dae08cd893f4617a17b3596","path_pattern_hash":"c8622d7ae4919e239b385d55fb4d268f"},"target_context":{"dst_port":7779,"service":"unreal-…
28/10/2026 04:23:23 UTC	TCP	6581 · HTTP	http	Sonde port 6581/TCP port 6581 tcp · via HTTP:6581 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6581 Chemin / cible / Preuve honeypot — Sonde port 6581/TCP Connexion détectée sur le port 6581 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 6581/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6581 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6581 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"8554b939d950cad1b9dbf00d409b9cc96b821ae0","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.124776292821557,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":6581,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":2.8,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"c699b0fa0728ffdb3896e2f1d8a6971bdc804602","event_fingerprint":"b173b2eb678ec7e4d555a5bec4c19948d3eee588","classification_reason":"Type \u00ab port_6581_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
28/10/2026 04:13:56 UTC	TCP	21239 · HTTP	http	Sonde port 21239/TCP port 21239 tcp · via HTTP:21239 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 21239 Chemin / cible / Preuve honeypot — Sonde port 21239/TCP Connexion détectée sur le port 21239 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 21239/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:21239 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connect Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:21239 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"8a3bb741d2320d29b27000d7bfe66e21111d6c40","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":147,"payload_entropy":5.104696560542176,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":21239,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":2,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"5282f2159a036f33a5157e7d87d43df4a189b35b","event_fingerprint":"6bc33e8c2e18bf8bfd7eb45afdff215da59bc1b2","classification_reason":"Type \u00ab port_21239_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
28/10/2026 04:10:55 UTC	TCP	12195 · HTTP	http	Sonde port 12195/TCP port 12195 tcp · via HTTP:12195 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12195 Chemin / cible / Preuve honeypot — Sonde port 12195/TCP Connexion détectée sur le port 12195 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 12195/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12195 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connect Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12195 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"81c791dd6b2d9a35765c73f31ae3e3c8b31b56f7","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":147,"payload_entropy":5.118126277896171,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":12195,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":3.3,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"1e7db769ab7b80fd4fd7316adf0dce05709e7727","event_fingerprint":"3a501a543204030285647b1df08239f6480b4608","classification_reason":"Type \u00ab port_12195_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"…
28/10/2026 04:10:24 UTC	TCP	12195 · HTTP	http	Sonde port 12195/TCP port 12195 tcp · via HTTP:12195 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12195 Chemin / cible / Preuve honeypot — Sonde port 12195/TCP Connexion détectée sur le port 12195 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 12195/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12195 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connect Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12195 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"81c791dd6b2d9a35765c73f31ae3e3c8b31b56f7","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":147,"payload_entropy":5.118126277896171,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":12195,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":3.3,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"1e7db769ab7b80fd4fd7316adf0dce05709e7727","event_fingerprint":"3a501a543204030285647b1df08239f6480b4608","classification_reason":"Type \u00ab port_12195_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"…
28/10/2026 04:06:42 UTC	TCP	16019 · HTTP	http	Sonde port 16019/TCP port 16019 tcp · via HTTP:16019 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 16019 Chemin / cible / Preuve honeypot — Sonde port 16019/TCP Connexion détectée sur le port 16019 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 16019/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:16019 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connect Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:16019 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"264e6ce323436ca12436d8dbf2b3b5c02debb5ed","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":147,"payload_entropy":5.126596430942677,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":16019,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":5.1,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"839c49b52be5f903d4be1ad67ab7b2f19e0a28a6","event_fingerprint":"cb563ab19eff2438febca08695ac5d11fe9c09e6","classification_reason":"Type \u00ab port_16019_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"…
28/10/2026 04:01:57 UTC	TCP	2351 · HTTP	http	Sonde port 2351/TCP port 2351 tcp · via HTTP:2351 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2351 Chemin / cible / Preuve honeypot — Sonde port 2351/TCP Connexion détectée sur le port 2351 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 2351/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2351 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2351 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"bcb9c792cbd8c6d5db5971f3096666ce0bb6c2b8","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.091524560134753,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":2351,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":5.6,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"3ea31e359d3cfe3d06eb6e52f8d798dd84406605","event_fingerprint":"a04e6b83d7b3ef0455cfe107fcae70a0cd74b714","classification_reason":"Type \u00ab port_2351_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
28/10/2026 03:52:30 UTC	TCP	3553 · HTTP	http	Sonde port 3553/TCP port 3553 tcp · via HTTP:3553 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3553 Chemin / cible / Preuve honeypot — Sonde port 3553/TCP Connexion détectée sur le port 3553 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 3553/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3553 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3553 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"a17d58acc4144207d525aa9b37c0861863ca17f3","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.0870381078604145,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":3553,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":4.4,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"0cdf132c20727df3ff2e034ea21f5da1320d4196","event_fingerprint":"0b990320d7886c1d3015bdd90ce888a7cd85fe3a","classification_reason":"Type \u00ab port_3553_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"G…
28/10/2026 03:18:25 UTC	TCP	1050 · HTTP	http	Sonde port 1050/TCP port 1050 tcp · via HTTP:1050 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1050 Chemin / cible / Preuve honeypot — Sonde port 1050/TCP Connexion détectée sur le port 1050 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 1050/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1050 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1050 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"8421baf3d3f4e47887a5970f687ad33d7439976a","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.105907200340986,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":1050,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":5.7,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"5a496fd96f7ede0e153c7f00447ce5f4fa07fa09","event_fingerprint":"76f3a90f6486f7a0f59e752d61bff2d19bf3fb5e","classification_reason":"Type \u00ab port_1050_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
28/10/2026 03:16:58 UTC	TCP	10399 · HTTP	http	Sonde port 10399/TCP port 10399 tcp · via HTTP:10399 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10399 Chemin / cible / Preuve honeypot — Sonde port 10399/TCP Connexion détectée sur le port 10399 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 10399/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:10399 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connect Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:10399 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"9024ba21c6ea9e7a23d6c22cee1f3f3e6425e584","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":147,"payload_entropy":5.124116648788935,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":10399,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":3.6,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"7f593910445ec66bb309a21dcc6a1eb856a6eb38","event_fingerprint":"1091b9e0f3e0946db8c242ab2e1174d7e8e6bd3b","classification_reason":"Type \u00ab port_10399_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"…
28/10/2026 02:50:29 UTC	TCP	2202 · HTTP	http	Sonde port 2202/TCP port 2202 tcp · via HTTP:2202 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2202 Chemin / cible / Preuve honeypot — Sonde port 2202/TCP Connexion détectée sur le port 2202 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 2202/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2202 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2202 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"d254a6d4649644044b64e1d015cc5c4cad1a9287","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.0836804024105975,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":2202,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":1.6,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"d5b75b794321c86f73b393046599c3e6e0608fa4","event_fingerprint":"ef9fd59fcfc77840938f5c8f6dce89120067aef1","classification_reason":"Type \u00ab port_2202_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"G…
28/10/2026 02:40:26 UTC	TCP	21234 · HTTP	http	Sonde port 21234/TCP port 21234 tcp · via HTTP:21234 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 21234 Chemin / cible / Preuve honeypot — Sonde port 21234/TCP Connexion détectée sur le port 21234 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 21234/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:21234 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connect Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:21234 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"8e26003a151cf8b4c7a4a0122dbeefbb6f487ab8","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":147,"payload_entropy":5.0910911183653065,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":21234,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":6.2,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"3c32379547c9c2e6c161dc611ca0ddc9f46dc46d","event_fingerprint":"ca02414104cb0e75889adbe8129ede544a71d1a5","classification_reason":"Type \u00ab port_21234_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":…
28/10/2026 02:27:30 UTC	TCP	12082 · HTTP	http	Sonde port 12082/TCP port 12082 tcp · via HTTP:12082 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12082 Chemin / cible / Preuve honeypot — Sonde port 12082/TCP Connexion détectée sur le port 12082 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 12082/TCP » (signaux protocolaires) · confiance 55% Confiance classification 63% Corrélation +8 Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12082 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connect Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12082 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"9f726fb95c52f72445dabbee2b7174a988127336","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":147,"payload_entropy":5.1156464957424275,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":12082,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":5.1,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"e47104cae9d4488ce4765fb76f0202b39ec1ed2d","event_fingerprint":"6fc9766ddc850c364293a406bcc10a2bc4f27dda","classification_reason":"Type \u00ab port_12082_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.63,"classification_confidence":0.63,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"B…

34.156.225.10

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence