14/06/2026 18:05:32 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /services/auth/.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /services/auth/.env HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit
Requête brute (extrait)
GET /services/auth/.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 259,
"payload_entropy": 5.396237677697737,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b2583dc00756914c6260d0e7f911100b",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit",
"request_sample": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit",
"evidence": {
"request_sample": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "19c349f93e6fd1522cf3330ce38b6b787ac96b8b",
"protocol_details": {
"payload_preview": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/services\/auth\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:32 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /api/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/53
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/53
Requête brute (extrait)
GET /api/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.36 Safari/535.7 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 252,
"payload_entropy": 5.407053149242786,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b196a8600246653b5a221e5883b07723",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/53",
"request_sample": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/535.7 (KHTML, like Gecko) Chrome\/16.0.912.36 Safari\/535.7\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/53",
"evidence": {
"request_sample": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/535.7 (KHTML, like Gecko) Chrome\/16.0.912.36 Safari\/535.7\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/53",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "472f47de3347cbc8a679e42cdc3c565ec72fd8d4",
"protocol_details": {
"payload_preview": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/53",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/53",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/53",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/api\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit\/53",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:32 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 44
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /config/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKi
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 44
Confiance : Confiance 0 % — 6 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /config/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKi
Requête brute (extrait)
GET /config/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 260,
"payload_entropy": 5.403740450704196,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 44,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "fe877a7756155d2222a1b1375c595b0011e73afe",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 44
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "865739997b3e88e6a9ed39200e706a43",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 44
},
"payload_preview": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKi",
"request_sample": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
"payload_snippet": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKi",
"evidence": {
"request_sample": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
"payload_snippet": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKi",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fc25284f30383cf62f1b8834a7f54103d2fe3dca",
"protocol_details": {
"payload_preview": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKi",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKi",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 44
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKi",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/config\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKi",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:32 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /email/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) Appl
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /email/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) Appl
Requête brute (extrait)
GET /email/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/7.0.3(0x17000321) NetType/WIFI Language/zh_CN Accept-Charset:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 308,
"payload_entropy": 5.469300398423299,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1db1b2ca73e8790295b3129906e1baea",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) Appl",
"request_sample": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Mobile\/15E148 MicroMessenger\/7.0.3(0x17000321) NetType\/WIFI Language\/zh_CN\r\nAccept-Charset:",
"payload_snippet": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) Appl",
"evidence": {
"request_sample": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Mobile\/15E148 MicroMessenger\/7.0.3(0x17000321) NetType\/WIFI Language\/zh_CN\r\nAccept-Charset:",
"payload_snippet": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) Appl",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1df6a7cbe12abe1794c7110049a26412c10be7d4",
"protocol_details": {
"payload_preview": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) Appl",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) Appl",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) Appl",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/email\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) Appl",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:32 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /mail/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /mail/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11
Requête brute (extrait)
GET /mail/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 198,
"payload_entropy": 5.28955622038989,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6c0d6c1d414409573068488b98f3369e",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11",
"request_sample": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11",
"evidence": {
"request_sample": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2db3bf8192a81b69dbb5b800472c3b61256c4de",
"protocol_details": {
"payload_preview": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/mail\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:32 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /mailer/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) App
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /mailer/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) App
Requête brute (extrait)
GET /mailer/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/74.0.3729.155 Mobile/15E148 Safari/605.1 Accept-Charset: utf-8 Accept-Encoding: gz
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 281,
"payload_entropy": 5.40840859515185,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "578c1e635741be412b439bee2c79dd55",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) App",
"request_sample": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/74.0.3729.155 Mobile\/15E148 Safari\/605.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gz",
"payload_snippet": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) App",
"evidence": {
"request_sample": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/74.0.3729.155 Mobile\/15E148 Safari\/605.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gz",
"payload_snippet": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) App",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a023e273ad118192f001d92d354ab09d747efb4d",
"protocol_details": {
"payload_preview": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) App",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) App",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) App",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/mailer\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) App",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:32 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /app/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /app/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like
Requête brute (extrait)
GET /app/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.39097200006298,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b33dd43029d7fa779ee4be67a007dfd8",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like",
"request_sample": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like",
"evidence": {
"request_sample": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3f0028026fe947aae6eaf34e7f60518ed197034",
"protocol_details": {
"payload_preview": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/app\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:32 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /src/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Linux; Android 7.1.1; Moto E (4) Plus) AppleWebK
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /src/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (Linux; Android 7.1.1; Moto E (4) Plus) AppleWebK
Requête brute (extrait)
GET /src/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Linux; Android 7.1.1; Moto E (4) Plus) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connectio
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 268,
"payload_entropy": 5.390745738723642,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8eef337fdb818623d3dfe7a050a3a0bf",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; Moto E (4) Plus) AppleWebK",
"request_sample": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; Moto E (4) Plus) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnectio",
"payload_snippet": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; Moto E (4) Plus) AppleWebK",
"evidence": {
"request_sample": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; Moto E (4) Plus) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnectio",
"payload_snippet": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; Moto E (4) Plus) AppleWebK",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0a3df034053bff8fd9ff720e02bbc8ac98983a03",
"protocol_details": {
"payload_preview": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; Moto E (4) Plus) AppleWebK",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; Moto E (4) Plus) AppleWebK",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; Moto E (4) Plus) AppleWebK",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/src\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.1; Moto E (4) Plus) AppleWebK",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:32 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Faible · 34
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
net_flood
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /backend/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: NetSurf/1.2 (NetBSD; amd64) Accept-Charset: utf-8 Accep
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /backend/sendgrid.env HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: NetSurf/1.2 (NetBSD; amd64)
Accept-Charset: utf-8
Accep
Requête brute (extrait)
GET /backend/sendgrid.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: NetSurf/1.2 (NetBSD; amd64) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 167,
"payload_entropy": 5.2651530026197095,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 34,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4c534dfcbc4ff30ad0edf86865b3d75c7daa6ecf",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ce83f1279865f7ccbcaf661806f7f0b1",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 34
},
"payload_preview": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: NetSurf\/1.2 (NetBSD; amd64)\r\nAccept-Charset: utf-8\r\nAccep",
"request_sample": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: NetSurf\/1.2 (NetBSD; amd64)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: NetSurf\/1.2 (NetBSD; amd64)\r\nAccept-Charset: utf-8\r\nAccep",
"evidence": {
"request_sample": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: NetSurf\/1.2 (NetBSD; amd64)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: NetSurf\/1.2 (NetBSD; amd64)\r\nAccept-Charset: utf-8\r\nAccep",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "65a10e057a261bbadae2c0df028cf32354e53b42",
"protocol_details": {
"payload_preview": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: NetSurf\/1.2 (NetBSD; amd64)\r\nAccept-Charset: utf-8\r\nAccep",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: NetSurf\/1.2 (NetBSD; amd64)\r\nAccept-Charset: utf-8\r\nAccep",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 34\/100 (Faible) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 34
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: NetSurf\/1.2 (NetBSD; amd64)\r\nAccept-Charset: utf-8\r\nAccep",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/backend\/sendgrid.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: NetSurf\/1.2 (NetBSD; amd64)\r\nAccept-Charset: utf-8\r\nAccep",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� ���&hg���i?�0~��/���!Y�J��к BNlk� j6��+��>A H�T]��; &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���&hg���i?�0~��/���!Y�J��к BNlk� j6��+��>A H�T]��; &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ���&hg���i?�0~��/���!Y�J��к BNlk� j6��+��>A H�T]��; &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �џT�7M������@�"^���Q~�)�9
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.8657757347476736,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5de763b221dbd055fc76d05fdfd7322a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd&hg\ufffd\ufffd\ufffdi?\ufffd0\u0014~\ufffd\ufffd\/\ufffd\ufffd\ufffd!Y\u001b\ufffd\u000eJ\ufffd\ufffd\u043a\u0017 B\u001bNlk\ufffd j\u00036\ufffd\ufffd\ue0c1+\ufffd\u0007\ufffd>A\u001fH\ufffdT]\ufffd\u0015\u0013\ufffd\u001a;\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd&hg\ufffd\ufffd\ufffdi?\ufffd0\u0014~\ufffd\ufffd\/\ufffd\ufffd\ufffd!Y\u001b\ufffd\u000eJ\ufffd\ufffd\u043a\u0017 B\u001bNlk\ufffd j\u00036\ufffd\ufffd\ue0c1+\ufffd\u0007\ufffd>A\u001fH\ufffdT]\ufffd\u0015\u0013\ufffd\u001a;\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u045fT\ufffd\u00057M\ufffd\u0010\u0012\ufffd\ufffd\ufffd\u0001\ufffd\ufffd@\ufffd\"^\ufffd\u0012\ufffd\ufffdQ~\ufffd)\ufffd9",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd&hg\ufffd\ufffd\ufffdi?\ufffd0\u0014~\ufffd\ufffd\/\ufffd\ufffd\ufffd!Y\u001b\ufffd\u000eJ\ufffd\ufffd\u043a\u0017 B\u001bNlk\ufffd j\u00036\ufffd\ufffd\ue0c1+\ufffd\u0007\ufffd>A\u001fH\ufffdT]\ufffd\u0015\u0013\ufffd\u001a;\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "abbc18c48e9fdb046917fdd5dd6efdab9fd39bf6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd&hg\ufffd\ufffd\ufffdi?\ufffd0\u0014~\ufffd\ufffd\/\ufffd\ufffd\ufffd!Y\u001b\ufffd\u000eJ\ufffd\ufffd\u043a\u0017 B\u001bNlk\ufffd j\u00036\ufffd\ufffd\ue0c1+\ufffd\u0007\ufffd>A\u001fH\ufffdT]\ufffd\u0015\u0013\ufffd\u001a;\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd&hg\ufffd\ufffd\ufffdi?\ufffd0~\ufffd\ufffd\/\ufffd\ufffd\ufffd!Y\ufffdJ\ufffd\ufffd\u043a BNlk\ufffd j6\ufffd\ufffd\ue0c1+\ufffd\ufffd>AH\ufffdT]\ufffd\ufffd;&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd&hg\ufffd\ufffd\ufffdi?\ufffd0\u0014~\ufffd\ufffd\/\ufffd\ufffd\ufffd!Y\u001b\ufffd\u000eJ\ufffd\ufffd\u043a\u0017 B\u001bNlk\ufffd j\u00036\ufffd\ufffd\ue0c1+\ufffd\u0007\ufffd>A\u001fH\ufffdT]\ufffd\u0015\u0013\ufffd\u001a;\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd&hg\ufffd\ufffd\ufffdi?\ufffd0~\ufffd\ufffd\/\ufffd\ufffd\ufffd!Y\ufffdJ\ufffd\ufffd\u043a BNlk\ufffd j6\ufffd\ufffd\ue0c1+\ufffd\ufffd>AH\ufffdT]\ufffd\ufffd;&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� ���8 2�����=?q#�O ���RYJtnb� ^�����.�sն伜6*$'س���� �T㶀� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���8 2�����=?q#�O ���RYJtnb� ^�����.�sն伜6*$'س���� �T㶀� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ���8 2�����=?q#�O ���RYJtnb� ^�����.�sն伜6*$'س���� �T㶀� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ i�p_���o��O�,��N�9�&l^C����O
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.878112828819072,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2a7eecac7173c076b15ff81758d7c9be",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd8\u0017 2\u000e\ufffd\ufffd\ufffd\ufffd\ufffd=?q#\ufffd\u0017O\u001c\ufffd\ufffd\ufffd\u0004RYJtnb\ufffd ^\ufffd\ufffd\ufffd\ufffd\ufffd.\ufffds\u0576\u4f1c6*$\u0010'\u0633\ufffd\ufffd\ufffd\ufffd\u000b\ufffdT\u3d80\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd8\u0017 2\u000e\ufffd\ufffd\ufffd\ufffd\ufffd=?q#\ufffd\u0017O\u001c\ufffd\ufffd\ufffd\u0004RYJtnb\ufffd ^\ufffd\ufffd\ufffd\ufffd\ufffd.\ufffds\u0576\u4f1c6*$\u0010'\u0633\ufffd\ufffd\ufffd\ufffd\u000b\ufffdT\u3d80\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 i\ufffdp_\ufffd\ufffd\ufffdo\ufffd\u0010\ufffdO\ufffd,\ufffd\ufffdN\ufffd9\ufffd&\u05ecl^\u0012C\ufffd\ufffd\ufffd\ufffdO",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd8\u0017 2\u000e\ufffd\ufffd\ufffd\ufffd\ufffd=?q#\ufffd\u0017O\u001c\ufffd\ufffd\ufffd\u0004RYJtnb\ufffd ^\ufffd\ufffd\ufffd\ufffd\ufffd.\ufffds\u0576\u4f1c6*$\u0010'\u0633\ufffd\ufffd\ufffd\ufffd\u000b\ufffdT\u3d80\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a0d90971f76373c1cc0e3785edbc0d9a12f9e4d3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd8\u0017 2\u000e\ufffd\ufffd\ufffd\ufffd\ufffd=?q#\ufffd\u0017O\u001c\ufffd\ufffd\ufffd\u0004RYJtnb\ufffd ^\ufffd\ufffd\ufffd\ufffd\ufffd.\ufffds\u0576\u4f1c6*$\u0010'\u0633\ufffd\ufffd\ufffd\ufffd\u000b\ufffdT\u3d80\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd8 2\ufffd\ufffd\ufffd\ufffd\ufffd=?q#\ufffdO\ufffd\ufffd\ufffdRYJtnb\ufffd ^\ufffd\ufffd\ufffd\ufffd\ufffd.\ufffds\u0576\u4f1c6*$'\u0633\ufffd\ufffd\ufffd\ufffd\ufffdT\u3d80\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd8\u0017 2\u000e\ufffd\ufffd\ufffd\ufffd\ufffd=?q#\ufffd\u0017O\u001c\ufffd\ufffd\ufffd\u0004RYJtnb\ufffd ^\ufffd\ufffd\ufffd\ufffd\ufffd.\ufffds\u0576\u4f1c6*$\u0010'\u0633\ufffd\ufffd\ufffd\ufffd\u000b\ufffdT\u3d80\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd8 2\ufffd\ufffd\ufffd\ufffd\ufffd=?q#\ufffdO\ufffd\ufffd\ufffdRYJtnb\ufffd ^\ufffd\ufffd\ufffd\ufffd\ufffd.\ufffds\u0576\u4f1c6*$'\u0633\ufffd\ufffd\ufffd\ufffd\ufffdT\u3d80\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� �E�|Z��|aC�JMa�X���6ۍ��"_TE�5r V)���M� �~ۊ�� Y9����_�t��s��6 &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �E�|Z��|aC�JMa�X���6ۍ��"_TE�5r V)���M� �~ۊ�� Y9����_�t��s��6 &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �E�|Z��|aC�JMa�X���6ۍ��"_TE�5r V)���M� �~ۊ�� Y9����_�t��s��6 &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ i�=/5Jp�G���~q�pGA܇��Q���mR�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.81960311128843,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "02501fbee579770075ffa011d7aea3e4",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003E\ufffd|Z\ufffd\ufffd|aC\u0004\ufffdJMa\ufffdX\ufffd\ufffd\ufffd6\u06cd\ufffd\ufffd\"\u0019_TE\ufffd5r V)\ufffd\ufffd\ufffdM\ufffd\u001e\ufffd~\u06ca\u0014\ufffd\ufffd\u001dY9\ufffd\ufffd\ufffd\ufffd_\ufffdt\ufffd\ufffd\u0001s\ufffd\ufffd6\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003E\ufffd|Z\ufffd\ufffd|aC\u0004\ufffdJMa\ufffdX\ufffd\ufffd\ufffd6\u06cd\ufffd\ufffd\"\u0019_TE\ufffd5r V)\ufffd\ufffd\ufffdM\ufffd\u001e\ufffd~\u06ca\u0014\ufffd\ufffd\u001dY9\ufffd\ufffd\ufffd\ufffd_\ufffdt\ufffd\ufffd\u0001s\ufffd\ufffd6\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 i\ufffd=\/5Jp\ufffdG\u0001\ufffd\ufffd\ufffd~q\ufffdpGA\u0707\ufffd\ufffdQ\ufffd\ufffd\ufffdmR\ufffd\b\u001c",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003E\ufffd|Z\ufffd\ufffd|aC\u0004\ufffdJMa\ufffdX\ufffd\ufffd\ufffd6\u06cd\ufffd\ufffd\"\u0019_TE\ufffd5r V)\ufffd\ufffd\ufffdM\ufffd\u001e\ufffd~\u06ca\u0014\ufffd\ufffd\u001dY9\ufffd\ufffd\ufffd\ufffd_\ufffdt\ufffd\ufffd\u0001s\ufffd\ufffd6\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "378011b437cbcb65b9a0e3dddf0ebaf984da8034",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003E\ufffd|Z\ufffd\ufffd|aC\u0004\ufffdJMa\ufffdX\ufffd\ufffd\ufffd6\u06cd\ufffd\ufffd\"\u0019_TE\ufffd5r V)\ufffd\ufffd\ufffdM\ufffd\u001e\ufffd~\u06ca\u0014\ufffd\ufffd\u001dY9\ufffd\ufffd\ufffd\ufffd_\ufffdt\ufffd\ufffd\u0001s\ufffd\ufffd6\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffdE\ufffd|Z\ufffd\ufffd|aC\ufffdJMa\ufffdX\ufffd\ufffd\ufffd6\u06cd\ufffd\ufffd\"_TE\ufffd5r V)\ufffd\ufffd\ufffdM\ufffd\ufffd~\u06ca\ufffd\ufffdY9\ufffd\ufffd\ufffd\ufffd_\ufffdt\ufffd\ufffds\ufffd\ufffd6&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003E\ufffd|Z\ufffd\ufffd|aC\u0004\ufffdJMa\ufffdX\ufffd\ufffd\ufffd6\u06cd\ufffd\ufffd\"\u0019_TE\ufffd5r V)\ufffd\ufffd\ufffdM\ufffd\u001e\ufffd~\u06ca\u0014\ufffd\ufffd\u001dY9\ufffd\ufffd\ufffd\ufffd_\ufffdt\ufffd\ufffd\u0001s\ufffd\ufffd6\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdE\ufffd|Z\ufffd\ufffd|aC\ufffdJMa\ufffdX\ufffd\ufffd\ufffd6\u06cd\ufffd\ufffd\"_TE\ufffd5r V)\ufffd\ufffd\ufffdM\ufffd\ufffd~\u06ca\ufffd\ufffdY9\ufffd\ufffd\ufffd\ufffd_\ufffdt\ufffd\ufffds\ufffd\ufffd6&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� ���r��o���B�B�%&˟M�Hq���� �7�9��?>�V_Ci�ڿ�dZ��t����� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���r��o���B�B�%&˟M�Hq���� �7�9��?>�V_Ci�ڿ�dZ��t����� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ���r��o���B�B�%&˟M�Hq���� �7�9��?>�V_Ci�ڿ�dZ��t����� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ hn��?��� J$ �t}ٞ�4�(�e�r�3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.856003153023485,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ee15a5f1b665d3e1e529e6bfa443c043",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0010\u001ar\ufffd\ufffdo\ufffd\ufffd\u0002\ufffd\u0011B\ufffdB\u0002\ufffd%&\u02dfM\ufffd\u0018Hq\ufffd\ufffd\ufffd\ufffd \ufffd7\ufffd9\ufffd\ufffd?>\ufffdV_Ci\ufffd\u06bf\ufffddZ\ufffd\ufffdt\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0010\u001ar\ufffd\ufffdo\ufffd\ufffd\u0002\ufffd\u0011B\ufffdB\u0002\ufffd%&\u02dfM\ufffd\u0018Hq\ufffd\ufffd\ufffd\ufffd \ufffd7\ufffd9\ufffd\ufffd?>\ufffdV_Ci\ufffd\u06bf\ufffddZ\ufffd\ufffdt\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 hn\ufffd\ufffd?\ufffd\ufffd\ufffd\u001fJ$\u001e\ufffdt}\u065e\ufffd\u00134\ufffd\u0019(\ufffde\ufffdr\ufffd\u001b3",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0010\u001ar\ufffd\ufffdo\ufffd\ufffd\u0002\ufffd\u0011B\ufffdB\u0002\ufffd%&\u02dfM\ufffd\u0018Hq\ufffd\ufffd\ufffd\ufffd \ufffd7\ufffd9\ufffd\ufffd?>\ufffdV_Ci\ufffd\u06bf\ufffddZ\ufffd\ufffdt\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "839e45a0c5812669cf3ccb0d292261f4a0fda31e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0010\u001ar\ufffd\ufffdo\ufffd\ufffd\u0002\ufffd\u0011B\ufffdB\u0002\ufffd%&\u02dfM\ufffd\u0018Hq\ufffd\ufffd\ufffd\ufffd \ufffd7\ufffd9\ufffd\ufffd?>\ufffdV_Ci\ufffd\u06bf\ufffddZ\ufffd\ufffdt\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffdo\ufffd\ufffd\ufffdB\ufffdB\ufffd%&\u02dfM\ufffdHq\ufffd\ufffd\ufffd\ufffd \ufffd7\ufffd9\ufffd\ufffd?>\ufffdV_Ci\ufffd\u06bf\ufffddZ\ufffd\ufffdt\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0010\u001ar\ufffd\ufffdo\ufffd\ufffd\u0002\ufffd\u0011B\ufffdB\u0002\ufffd%&\u02dfM\ufffd\u0018Hq\ufffd\ufffd\ufffd\ufffd \ufffd7\ufffd9\ufffd\ufffd?>\ufffdV_Ci\ufffd\u06bf\ufffddZ\ufffd\ufffdt\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffdo\ufffd\ufffd\ufffdB\ufffdB\ufffd%&\u02dfM\ufffdHq\ufffd\ufffd\ufffd\ufffd \ufffd7\ufffd9\ufffd\ufffd?>\ufffdV_Ci\ufffd\u06bf\ufffddZ\ufffd\ufffdt\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� �2�g�-,�����9 ����M�L���؎R�4 �� b��Km��m%!�|n3���g�(C�У &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �2�g�-,�����9 ����M�L���؎R�4
�� b��Km��m%!�|n3���g�(C�У &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �2�g�-,�����9 ����M�L���؎R�4 �� b��Km��m%!�|n3���g�(C�У &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �Pz�ק^�OG�=].zu�� � ��� �� -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.8714850205001845,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "467a47f20961be8aee365058fb21ed50",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00032\ufffd\u0003g\ufffd-\u0015,\ufffd\ufffd\ufffd\u001a\ufffd\ufffd9\u0000\ufffd\ufffd\ufffd\ufffdM\ufffdL\ufffd\ufffd\ufffd\u060eR\ufffd4\r \ufffd\ufffd\u0007\u000bb\ufffd\ufffdKm\u000f\ufffd\ufffdm%!\ufffd|n3\ufffd\ufffd\ufffdg\ufffd\u0e7e(C\ufffd\u0423\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00032\ufffd\u0003g\ufffd-\u0015,\ufffd\ufffd\ufffd\u001a\ufffd\ufffd9\u0000\ufffd\ufffd\ufffd\ufffdM\ufffdL\ufffd\ufffd\ufffd\u060eR\ufffd4\r \ufffd\ufffd\u0007\u000bb\ufffd\ufffdKm\u000f\ufffd\ufffdm%!\ufffd|n3\ufffd\ufffd\ufffdg\ufffd\u0e7e(C\ufffd\u0423\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdPz\ufffd\u05e7^\ufffdOG\ufffd=].zu\ufffd\ufffd\t\ufffd \u001b\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u0000-\u0015",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00032\ufffd\u0003g\ufffd-\u0015,\ufffd\ufffd\ufffd\u001a\ufffd\ufffd9\u0000\ufffd\ufffd\ufffd\ufffdM\ufffdL\ufffd\ufffd\ufffd\u060eR\ufffd4\r \ufffd\ufffd\u0007\u000bb\ufffd\ufffdKm\u000f\ufffd\ufffdm%!\ufffd|n3\ufffd\ufffd\ufffdg\ufffd\u0e7e(C\ufffd\u0423\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cd753c462adcd792dcdb3180fda3feb64a537779",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00032\ufffd\u0003g\ufffd-\u0015,\ufffd\ufffd\ufffd\u001a\ufffd\ufffd9\u0000\ufffd\ufffd\ufffd\ufffdM\ufffdL\ufffd\ufffd\ufffd\u060eR\ufffd4\r \ufffd\ufffd\u0007\u000bb\ufffd\ufffdKm\u000f\ufffd\ufffdm%!\ufffd|n3\ufffd\ufffd\ufffdg\ufffd\u0e7e(C\ufffd\u0423\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd2\ufffdg\ufffd-,\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffd\ufffd\ufffdM\ufffdL\ufffd\ufffd\ufffd\u060eR\ufffd4\r \ufffd\ufffdb\ufffd\ufffdKm\ufffd\ufffdm%!\ufffd|n3\ufffd\ufffd\ufffdg\ufffd\u0e7e(C\ufffd\u0423&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00032\ufffd\u0003g\ufffd-\u0015,\ufffd\ufffd\ufffd\u001a\ufffd\ufffd9\u0000\ufffd\ufffd\ufffd\ufffdM\ufffdL\ufffd\ufffd\ufffd\u060eR\ufffd4\r \ufffd\ufffd\u0007\u000bb\ufffd\ufffdKm\u000f\ufffd\ufffdm%!\ufffd|n3\ufffd\ufffd\ufffdg\ufffd\u0e7e(C\ufffd\u0423\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd2\ufffdg\ufffd-,\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffd\ufffd\ufffdM\ufffdL\ufffd\ufffd\ufffd\u060eR\ufffd4\r \ufffd\ufffdb\ufffd\ufffdKm\ufffd\ufffdm%!\ufffd|n3\ufffd\ufffd\ufffdg\ufffd\u0e7e(C\ufffd\u0423&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� � ��mq��=q��r�DĨ�� ��5�ݷL� �iS'�~�>� ��ע��%k�^�Q<\0��� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � ��mq��=q��r�DĨ�� ��5�ݷL� �iS'�~�>�
��ע��%k�^�Q<\0��� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� � ��mq��=q��r�DĨ�� ��5�ݷL� �iS'�~�>� ��ע��%k�^�Q<\0��� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ j�8�Q��� !{�G=�^�pGlR�t�` &
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.795990542987342,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c6e33c68d613748639eb5ed588a0d49d",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0006\u001d\ufffd\u0013\ufffdmq\ufffd\ufffd=q\ufffd\ufffdr\ufffdD\u0128\ufffd\ufffd\u001e\u0019\ufffd\ufffd5\ufffd\u001b\u0777L\ufffd \ufffdiS'\ufffd~\ufffd>\ufffd\n\ufffd\ufffd\u05e2\b\ufffd\ufffd%k\ufffd^\ufffdQ<\\0\ufffd\u0019\ufffd\u001b\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0006\u001d\ufffd\u0013\ufffdmq\ufffd\ufffd=q\ufffd\ufffdr\ufffdD\u0128\ufffd\ufffd\u001e\u0019\ufffd\ufffd5\ufffd\u001b\u0777L\ufffd \ufffdiS'\ufffd~\ufffd>\ufffd\n\ufffd\ufffd\u05e2\b\ufffd\ufffd%k\ufffd^\ufffdQ<\\0\ufffd\u0019\ufffd\u001b\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 j\ufffd8\ufffdQ\u0006\ufffd\ufffd\ufffd\u0000!{\ufffdG\u0003=\ufffd^\ufffd\u0015pGlR\ufffdt\ufffd`\u001d &\u001e",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0006\u001d\ufffd\u0013\ufffdmq\ufffd\ufffd=q\ufffd\ufffdr\ufffdD\u0128\ufffd\ufffd\u001e\u0019\ufffd\ufffd5\ufffd\u001b\u0777L\ufffd \ufffdiS'\ufffd~\ufffd>\ufffd\n\ufffd\ufffd\u05e2\b\ufffd\ufffd%k\ufffd^\ufffdQ<\\0\ufffd\u0019\ufffd\u001b\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "526cd67a49073418fd9599c71164a06572e6aa6c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0006\u001d\ufffd\u0013\ufffdmq\ufffd\ufffd=q\ufffd\ufffdr\ufffdD\u0128\ufffd\ufffd\u001e\u0019\ufffd\ufffd5\ufffd\u001b\u0777L\ufffd \ufffdiS'\ufffd~\ufffd>\ufffd\n\ufffd\ufffd\u05e2\b\ufffd\ufffd%k\ufffd^\ufffdQ<\\0\ufffd\u0019\ufffd\u001b\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdmq\ufffd\ufffd=q\ufffd\ufffdr\ufffdD\u0128\ufffd\ufffd\ufffd\ufffd5\ufffd\u0777L\ufffd \ufffdiS'\ufffd~\ufffd>\ufffd\n\ufffd\ufffd\u05e2\ufffd\ufffd%k\ufffd^\ufffdQ<\\0\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0006\u001d\ufffd\u0013\ufffdmq\ufffd\ufffd=q\ufffd\ufffdr\ufffdD\u0128\ufffd\ufffd\u001e\u0019\ufffd\ufffd5\ufffd\u001b\u0777L\ufffd \ufffdiS'\ufffd~\ufffd>\ufffd\n\ufffd\ufffd\u05e2\b\ufffd\ufffd%k\ufffd^\ufffdQ<\\0\ufffd\u0019\ufffd\u001b\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdmq\ufffd\ufffd=q\ufffd\ufffdr\ufffdD\u0128\ufffd\ufffd\ufffd\ufffd5\ufffd\u0777L\ufffd \ufffdiS'\ufffd~\ufffd>\ufffd\n\ufffd\ufffd\u05e2\ufffd\ufffd%k\ufffd^\ufffdQ<\\0\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� �� �� {�������u'�%1�.� �XJ` � QU��K*�������e�!ͱ���I�>`墜 &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �� �� {�������u'�%1�.� �XJ` � QU��K*�������e�!ͱ���I�>`墜 &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �� �� {�������u'�%1�.� �XJ` � QU��K*�������e�!ͱ���I�>`墜 &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �� �J���Xx�K-�DyH^�id�\���F
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.866626194313033,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "72d9d5d4e9d72d50636f2d605594011e",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000e\ufffd\u0013\u0000\ufffd\ufffd\u0000{\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu'\ufffd%1\ufffd.\ufffd\u000f\u001f\u0005\ufffdXJ` \ufffd\u001f\u001dQU\ufffd\ufffdK*\ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffde\ufffd!\u0371\ufffd\ufffd\ufffdI\ufffd>`\u589c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000e\ufffd\u0013\u0000\ufffd\ufffd\u0000{\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu'\ufffd%1\ufffd.\ufffd\u000f\u001f\u0005\ufffdXJ` \ufffd\u001f\u001dQU\ufffd\ufffdK*\ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffde\ufffd!\u0371\ufffd\ufffd\ufffdI\ufffd>`\u589c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u000e\ufffd\f\ufffdJ\ufffd\ufffd\ufffdX\u0013x\ufffdK-\ufffd\u000eDy\u0015H^\ufffdid\ufffd\\\ufffd\ufffd\ufffdF",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000e\ufffd\u0013\u0000\ufffd\ufffd\u0000{\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu'\ufffd%1\ufffd.\ufffd\u000f\u001f\u0005\ufffdXJ` \ufffd\u001f\u001dQU\ufffd\ufffdK*\ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffde\ufffd!\u0371\ufffd\ufffd\ufffdI\ufffd>`\u589c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d125120c7b4a05326c7de8180a47ffb77f4d4e9b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000e\ufffd\u0013\u0000\ufffd\ufffd\u0000{\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu'\ufffd%1\ufffd.\ufffd\u000f\u001f\u0005\ufffdXJ` \ufffd\u001f\u001dQU\ufffd\ufffdK*\ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffde\ufffd!\u0371\ufffd\ufffd\ufffdI\ufffd>`\u589c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu'\ufffd%1\ufffd.\ufffd\ufffdXJ` \ufffdQU\ufffd\ufffdK*\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd!\u0371\ufffd\ufffd\ufffdI\ufffd>`\u589c&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000e\ufffd\u0013\u0000\ufffd\ufffd\u0000{\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu'\ufffd%1\ufffd.\ufffd\u000f\u001f\u0005\ufffdXJ` \ufffd\u001f\u001dQU\ufffd\ufffdK*\ufffd\ufffd\ufffd\ufffd\ufffd\u0017\ufffd\ufffde\ufffd!\u0371\ufffd\ufffd\ufffdI\ufffd>`\u589c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu'\ufffd%1\ufffd.\ufffd\ufffdXJ` \ufffdQU\ufffd\ufffdK*\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd!\u0371\ufffd\ufffd\ufffdI\ufffd>`\u589c&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� �[��� W�A�v�Rܢ���m��1�:��Bҵ� :���ՈĞ�5W��������7(��Z��P�J�� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �[���
W�A�v�Rܢ���m��1�:��Bҵ� :���ՈĞ�5W��������7(��Z��P�J�� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �[��� W�A�v�Rܢ���m��1�:��Bҵ� :���ՈĞ�5W��������7(��Z��P�J�� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ ��x 2�$��P���!�}�G*��;$7 � �;
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.793384733761376,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d7161649307ffb072d374b724bbfaca7",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003[\ufffd\ufffd\ufffd\nW\ufffdA\ufffdv\ufffdR\u0003\u0722\ufffd\ufffd\ufffdm\u001b\ufffd\ufffd1\ufffd\u0012:\ufffd\ufffdB\u04b5\ufffd :\ufffd\ufffd\ufffd\u0548\u011e\ufffd5W\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffd7(\ufffd\ufffdZ\ufffd\ufffdP\ufffdJ\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003[\ufffd\ufffd\ufffd\nW\ufffdA\ufffdv\ufffdR\u0003\u0722\ufffd\ufffd\ufffdm\u001b\ufffd\ufffd1\ufffd\u0012:\ufffd\ufffdB\u04b5\ufffd :\ufffd\ufffd\ufffd\u0548\u011e\ufffd5W\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffd7(\ufffd\ufffdZ\ufffd\ufffdP\ufffdJ\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdx\f\t2\ufffd$\ufffd\ufffdP\ufffd\ufffd\ufffd!\ufffd}\ufffdG*\ufffd\ufffd;$7\f\ufffd\u0017\f\ufffd;",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003[\ufffd\ufffd\ufffd\nW\ufffdA\ufffdv\ufffdR\u0003\u0722\ufffd\ufffd\ufffdm\u001b\ufffd\ufffd1\ufffd\u0012:\ufffd\ufffdB\u04b5\ufffd :\ufffd\ufffd\ufffd\u0548\u011e\ufffd5W\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffd7(\ufffd\ufffdZ\ufffd\ufffdP\ufffdJ\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e2cfffb47e593714d15393dfe6583c2bdc402476",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003[\ufffd\ufffd\ufffd\nW\ufffdA\ufffdv\ufffdR\u0003\u0722\ufffd\ufffd\ufffdm\u001b\ufffd\ufffd1\ufffd\u0012:\ufffd\ufffdB\u04b5\ufffd :\ufffd\ufffd\ufffd\u0548\u011e\ufffd5W\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffd7(\ufffd\ufffdZ\ufffd\ufffdP\ufffdJ\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd[\ufffd\ufffd\ufffd\nW\ufffdA\ufffdv\ufffdR\u0722\ufffd\ufffd\ufffdm\ufffd\ufffd1\ufffd:\ufffd\ufffdB\u04b5\ufffd :\ufffd\ufffd\ufffd\u0548\u011e\ufffd5W\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd7(\ufffd\ufffdZ\ufffd\ufffdP\ufffdJ\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003[\ufffd\ufffd\ufffd\nW\ufffdA\ufffdv\ufffdR\u0003\u0722\ufffd\ufffd\ufffdm\u001b\ufffd\ufffd1\ufffd\u0012:\ufffd\ufffdB\u04b5\ufffd :\ufffd\ufffd\ufffd\u0548\u011e\ufffd5W\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\ufffd7(\ufffd\ufffdZ\ufffd\ufffdP\ufffdJ\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd[\ufffd\ufffd\ufffd\nW\ufffdA\ufffdv\ufffdR\u0722\ufffd\ufffd\ufffdm\ufffd\ufffd1\ufffd:\ufffd\ufffdB\u04b5\ufffd :\ufffd\ufffd\ufffd\u0548\u011e\ufffd5W\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd7(\ufffd\ufffdZ\ufffd\ufffdP\ufffdJ\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� ����_ZR-��W��I[�"��3/$c� ��' :��5a��%����ɨsV���sH�����>>� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����_ZR-��W��I[�"��3/$c� ��' :��5a��%����ɨsV���sH�����>>� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ����_ZR-��W��I[�"��3/$c� ��' :��5a��%����ɨsV���sH�����>>� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ >��2r�]"�5LܨW������{O�sM$,]
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.750900996208571,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fbb2631d96a2993fdcdb804639828a9d",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd_ZR-\ufffd\ufffdW\ufffd\ufffdI[\ufffd\"\u0002\ufffd\ufffd3\u0007\/$c\ufffd\u0014\u001d\u001a\ufffd\ufffd' \u0013:\ufffd\ufffd5a\ufffd\ufffd%\ufffd\ufffd\ufffd\ufffd\u0268sV\ufffd\ufffd\ufffdsH\ufffd\u0004\ufffd\ufffd\ufffd\ufffd>>\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd_ZR-\ufffd\ufffdW\ufffd\ufffdI[\ufffd\"\u0002\ufffd\ufffd3\u0007\/$c\ufffd\u0014\u001d\u001a\ufffd\ufffd' \u0013:\ufffd\ufffd5a\ufffd\ufffd%\ufffd\ufffd\ufffd\ufffd\u0268sV\ufffd\ufffd\ufffdsH\ufffd\u0004\ufffd\ufffd\ufffd\ufffd>>\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \n>\ufffd\ufffd2\u000er\ufffd]\"\ufffd\u00075L\u0728W\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{O\ufffdsM$,]",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd_ZR-\ufffd\ufffdW\ufffd\ufffdI[\ufffd\"\u0002\ufffd\ufffd3\u0007\/$c\ufffd\u0014\u001d\u001a\ufffd\ufffd' \u0013:\ufffd\ufffd5a\ufffd\ufffd%\ufffd\ufffd\ufffd\ufffd\u0268sV\ufffd\ufffd\ufffdsH\ufffd\u0004\ufffd\ufffd\ufffd\ufffd>>\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "729336d70ec01ade54225bc8fd0096b175f62b0d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd_ZR-\ufffd\ufffdW\ufffd\ufffdI[\ufffd\"\u0002\ufffd\ufffd3\u0007\/$c\ufffd\u0014\u001d\u001a\ufffd\ufffd' \u0013:\ufffd\ufffd5a\ufffd\ufffd%\ufffd\ufffd\ufffd\ufffd\u0268sV\ufffd\ufffd\ufffdsH\ufffd\u0004\ufffd\ufffd\ufffd\ufffd>>\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd_ZR-\ufffd\ufffdW\ufffd\ufffdI[\ufffd\"\ufffd\ufffd3\/$c\ufffd\ufffd\ufffd' :\ufffd\ufffd5a\ufffd\ufffd%\ufffd\ufffd\ufffd\ufffd\u0268sV\ufffd\ufffd\ufffdsH\ufffd\ufffd\ufffd\ufffd\ufffd>>\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd_ZR-\ufffd\ufffdW\ufffd\ufffdI[\ufffd\"\u0002\ufffd\ufffd3\u0007\/$c\ufffd\u0014\u001d\u001a\ufffd\ufffd' \u0013:\ufffd\ufffd5a\ufffd\ufffd%\ufffd\ufffd\ufffd\ufffd\u0268sV\ufffd\ufffd\ufffdsH\ufffd\u0004\ufffd\ufffd\ufffd\ufffd>>\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd_ZR-\ufffd\ufffdW\ufffd\ufffdI[\ufffd\"\ufffd\ufffd3\/$c\ufffd\ufffd\ufffd' :\ufffd\ufffd5a\ufffd\ufffd%\ufffd\ufffd\ufffd\ufffd\u0268sV\ufffd\ufffd\ufffdsH\ufffd\ufffd\ufffd\ufffd\ufffd>>\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� �#��E�#�/��w�f-�,]9X��p��b��9�4� ���3�� ��IG{ :��0u3�� @@ �y &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �#��E�#�/��w�f-�,]9X��p��b��9�4� ���3��
��IG{ :��0u3�� @@ �y
&�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �#��E�#�/��w�f-�,]9X��p��b��9�4� ���3�� ��IG{ :��0u3�� @@ �y &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ ğdb��F��^{��Zӓ�;�Ϙ�J�k�� U
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.85932527653592,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "54a18451f0d00bf388d24a9116af811e",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003#\ufffd\ufffdE\ufffd#\ufffd\/\ufffd\ufffdw\ufffdf-\u0007\ufffd,]9X\ufffd\ufffdp\ufffd\ufffdb\ufffd\ufffd9\ufffd4\ufffd \ufffd\ufffd\ufffd3\ufffd\ufffd\r\u0014\ufffd\u001b\ufffdIG{\u001f:\b\ufffd\ufffd0u3\ufffd\ufffd\u0016\u001e@@ \ufffdy\r\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003#\ufffd\ufffdE\ufffd#\ufffd\/\ufffd\ufffdw\ufffdf-\u0007\ufffd,]9X\ufffd\ufffdp\ufffd\ufffdb\ufffd\ufffd9\ufffd4\ufffd \ufffd\ufffd\ufffd3\ufffd\ufffd\r\u0014\ufffd\u001b\ufffdIG{\u001f:\b\ufffd\ufffd0u3\ufffd\ufffd\u0016\u001e@@ \ufffdy\r\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u011fdb\ufffd\ufffdF\ufffd\ufffd\u0006\u0010^{\ufffd\ufffdZ\u04d3\ufffd;\ufffd\u03d8\ufffdJ\u000f\ufffdk\ufffd\ufffd\u000bU",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003#\ufffd\ufffdE\ufffd#\ufffd\/\ufffd\ufffdw\ufffdf-\u0007\ufffd,]9X\ufffd\ufffdp\ufffd\ufffdb\ufffd\ufffd9\ufffd4\ufffd \ufffd\ufffd\ufffd3\ufffd\ufffd\r\u0014\ufffd\u001b\ufffdIG{\u001f:\b\ufffd\ufffd0u3\ufffd\ufffd\u0016\u001e@@ \ufffdy\r\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "47ff7f8aded82d2b0fa8fc05957bef8013391c79",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003#\ufffd\ufffdE\ufffd#\ufffd\/\ufffd\ufffdw\ufffdf-\u0007\ufffd,]9X\ufffd\ufffdp\ufffd\ufffdb\ufffd\ufffd9\ufffd4\ufffd \ufffd\ufffd\ufffd3\ufffd\ufffd\r\u0014\ufffd\u001b\ufffdIG{\u001f:\b\ufffd\ufffd0u3\ufffd\ufffd\u0016\u001e@@ \ufffdy\r\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd#\ufffd\ufffdE\ufffd#\ufffd\/\ufffd\ufffdw\ufffdf-\ufffd,]9X\ufffd\ufffdp\ufffd\ufffdb\ufffd\ufffd9\ufffd4\ufffd \ufffd\ufffd\ufffd3\ufffd\ufffd\r\ufffd\ufffdIG{:\ufffd\ufffd0u3\ufffd\ufffd@@ \ufffdy\r&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003#\ufffd\ufffdE\ufffd#\ufffd\/\ufffd\ufffdw\ufffdf-\u0007\ufffd,]9X\ufffd\ufffdp\ufffd\ufffdb\ufffd\ufffd9\ufffd4\ufffd \ufffd\ufffd\ufffd3\ufffd\ufffd\r\u0014\ufffd\u001b\ufffdIG{\u001f:\b\ufffd\ufffd0u3\ufffd\ufffd\u0016\u001e@@ \ufffdy\r\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd#\ufffd\ufffdE\ufffd#\ufffd\/\ufffd\ufffdw\ufffdf-\ufffd,]9X\ufffd\ufffdp\ufffd\ufffdb\ufffd\ufffd9\ufffd4\ufffd \ufffd\ufffd\ufffd3\ufffd\ufffd\r\ufffd\ufffdIG{:\ufffd\ufffd0u3\ufffd\ufffd@@ \ufffdy\r&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� �Ta�%a� T$ �\j����T���r�����b�} �����g�9����+ L�j�\[��K�zNɍ�b &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Ta�%a� T$ �\j����T���r�����b�} �����g�9����+ L�j�\[��K�zNɍ�b &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �Ta�%a� T$ �\j����T���r�����b�} �����g�9����+ L�j�\[��K�zNɍ�b &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �+[���) J��{D�ݧ"�� �;��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.813732820668809,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "10ea9b87e8b973c39c07f1555941d2b2",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Ta\ufffd%a\ufffd\u0017\u000e\tT$\u000b\ufffd\\j\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd} \ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd9\u0014\ufffd\ufffd\ufffd\u0006\ufffd+\u001eL\ufffdj\ufffd\\[\ufffd\ufffdK\ufffdzN\u024d\ufffdb\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Ta\ufffd%a\ufffd\u0017\u000e\tT$\u000b\ufffd\\j\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd} \ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd9\u0014\ufffd\ufffd\ufffd\u0006\ufffd+\u001eL\ufffdj\ufffd\\[\ufffd\ufffdK\ufffdzN\u024d\ufffdb\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0015\u001e\ufffd+[\ufffd\ufffd\ufffd)\u000b\u0002\u001eJ\ufffd\ufffd{D\u0005\ufffd\u001a\u0767\"\ufffd\ufffd\u000b\ufffd;\ufffd\ufffd\u0016",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Ta\ufffd%a\ufffd\u0017\u000e\tT$\u000b\ufffd\\j\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd} \ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd9\u0014\ufffd\ufffd\ufffd\u0006\ufffd+\u001eL\ufffdj\ufffd\\[\ufffd\ufffdK\ufffdzN\u024d\ufffdb\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "905eb2c9f0a3e502fd1bb6ef1f6890ec5133e478",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Ta\ufffd%a\ufffd\u0017\u000e\tT$\u000b\ufffd\\j\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd} \ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd9\u0014\ufffd\ufffd\ufffd\u0006\ufffd+\u001eL\ufffdj\ufffd\\[\ufffd\ufffdK\ufffdzN\u024d\ufffdb\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffdTa\ufffd%a\ufffd\tT$\ufffd\\j\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd} \ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd9\ufffd\ufffd\ufffd\ufffd+L\ufffdj\ufffd\\[\ufffd\ufffdK\ufffdzN\u024d\ufffdb&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Ta\ufffd%a\ufffd\u0017\u000e\tT$\u000b\ufffd\\j\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd} \ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd9\u0014\ufffd\ufffd\ufffd\u0006\ufffd+\u001eL\ufffdj\ufffd\\[\ufffd\ufffdK\ufffdzN\u024d\ufffdb\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdTa\ufffd%a\ufffd\tT$\ufffd\\j\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd} \ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd9\ufffd\ufffd\ufffd\ufffd+L\ufffdj\ufffd\\[\ufffd\ufffdK\ufffdzN\u024d\ufffdb&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� ��,�OT0'�Z|�&m��S� �����_�B�� #ד�\�AL���C"� �k%���h�I�ӷ�;� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��,�OT0'�Z|�&m��S�
�����_�B�� #ד�\�AL���C"� �k%���h�I�ӷ�;� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ��,�OT0'�Z|�&m��S� �����_�B�� #ד�\�AL���C"� �k%���h�I�ӷ�;� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �.�� t�pZ�-8|-��� =���B�B�'p�&
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.8673369180321195,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ccc3763a92a3d5ce8e8221beea357fb6",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd,\u001a\u0002\ufffdOT0'\ufffdZ|\ufffd&m\ufffd\ufffdS\ufffd\n\ufffd\u0011\ufffd\ufffd\ufffd\ufffd_\ufffdB\ufffd\ufffd #\u05d3\ufffd\\\ufffdAL\ufffd\ufffd\ufffdC\"\ufffd\u000b\ufffdk%\ufffd\ufffd\ufffd\u0015h\ufffdI\ufffd\u04f7\ufffd;\ufffd\u001a\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd,\u001a\u0002\ufffdOT0'\ufffdZ|\ufffd&m\ufffd\ufffdS\ufffd\n\ufffd\u0011\ufffd\ufffd\ufffd\ufffd_\ufffdB\ufffd\ufffd #\u05d3\ufffd\\\ufffdAL\ufffd\ufffd\ufffdC\"\ufffd\u000b\ufffdk%\ufffd\ufffd\ufffd\u0015h\ufffdI\ufffd\u04f7\ufffd;\ufffd\u001a\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd.\ufffd\ufffd\u001ft\ufffdpZ\ufffd-8|-\ufffd\ufffd\ufffd\u000b=\ufffd\ufffd\ufffdB\ufffdB\ufffd\u0003'p\ufffd&",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd,\u001a\u0002\ufffdOT0'\ufffdZ|\ufffd&m\ufffd\ufffdS\ufffd\n\ufffd\u0011\ufffd\ufffd\ufffd\ufffd_\ufffdB\ufffd\ufffd #\u05d3\ufffd\\\ufffdAL\ufffd\ufffd\ufffdC\"\ufffd\u000b\ufffdk%\ufffd\ufffd\ufffd\u0015h\ufffdI\ufffd\u04f7\ufffd;\ufffd\u001a\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e60e4df6ee2fd0dbbb0b2408d629b783bec2b52c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd,\u001a\u0002\ufffdOT0'\ufffdZ|\ufffd&m\ufffd\ufffdS\ufffd\n\ufffd\u0011\ufffd\ufffd\ufffd\ufffd_\ufffdB\ufffd\ufffd #\u05d3\ufffd\\\ufffdAL\ufffd\ufffd\ufffdC\"\ufffd\u000b\ufffdk%\ufffd\ufffd\ufffd\u0015h\ufffdI\ufffd\u04f7\ufffd;\ufffd\u001a\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd,\ufffdOT0'\ufffdZ|\ufffd&m\ufffd\ufffdS\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd_\ufffdB\ufffd\ufffd #\u05d3\ufffd\\\ufffdAL\ufffd\ufffd\ufffdC\"\ufffd\ufffdk%\ufffd\ufffd\ufffdh\ufffdI\ufffd\u04f7\ufffd;\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd,\u001a\u0002\ufffdOT0'\ufffdZ|\ufffd&m\ufffd\ufffdS\ufffd\n\ufffd\u0011\ufffd\ufffd\ufffd\ufffd_\ufffdB\ufffd\ufffd #\u05d3\ufffd\\\ufffdAL\ufffd\ufffd\ufffdC\"\ufffd\u000b\ufffdk%\ufffd\ufffd\ufffd\u0015h\ufffdI\ufffd\u04f7\ufffd;\ufffd\u001a\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd,\ufffdOT0'\ufffdZ|\ufffd&m\ufffd\ufffdS\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd_\ufffdB\ufffd\ufffd #\u05d3\ufffd\\\ufffdAL\ufffd\ufffd\ufffdC\"\ufffd\ufffdk%\ufffd\ufffd\ufffdh\ufffdI\ufffd\u04f7\ufffd;\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� ���*x�����sH/V�?~f�G�ov�V ����HO �E��ON_0G3$�Gz�F� Y�����{� � &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���*x�����sH/V�?~f�G�ov�V ����HO �E��ON_0G3$�Gz�F� Y�����{� � &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ���*x�����sH/V�?~f�G�ov�V ����HO �E��ON_0G3$�Gz�F� Y�����{� � &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ c�M�H���$�� jd�����>��b�!�(��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.772258396092656,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "01211c4fb37d31e83bbb3575eb4bd852",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd*x\ufffd\ufffd\ufffd\ufffd\ufffdsH\/V\ufffd?~f\ufffdG\ufffdov\ufffdV\u0000\ufffd\ufffd\ufffd\ufffdHO \ufffdE\ufffd\ufffdON_0\u0001G3$\ufffdG\u001az\ufffdF\ufffd\u001a Y\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\u0005\u001d\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd*x\ufffd\ufffd\ufffd\ufffd\ufffdsH\/V\ufffd?~f\ufffdG\ufffdov\ufffdV\u0000\ufffd\ufffd\ufffd\ufffdHO \ufffdE\ufffd\ufffdON_0\u0001G3$\ufffdG\u001az\ufffdF\ufffd\u001a Y\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\u0005\u001d\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 c\ufffdM\u0013\ufffdH\ufffd\ufffd\ufffd$\ufffd\ufffd\u001fjd\ufffd\ufffd\ufffd\u0010\ufffd\ufffd>\ufffd\ufffdb\ufffd!\ufffd(\ufffd\ufffd\u0014",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd*x\ufffd\ufffd\ufffd\ufffd\ufffdsH\/V\ufffd?~f\ufffdG\ufffdov\ufffdV\u0000\ufffd\ufffd\ufffd\ufffdHO \ufffdE\ufffd\ufffdON_0\u0001G3$\ufffdG\u001az\ufffdF\ufffd\u001a Y\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\u0005\u001d\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bf8583b51917359c5fd7bfc3f18b8f27fb867cf6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd*x\ufffd\ufffd\ufffd\ufffd\ufffdsH\/V\ufffd?~f\ufffdG\ufffdov\ufffdV\u0000\ufffd\ufffd\ufffd\ufffdHO \ufffdE\ufffd\ufffdON_0\u0001G3$\ufffdG\u001az\ufffdF\ufffd\u001a Y\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\u0005\u001d\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd*x\ufffd\ufffd\ufffd\ufffd\ufffdsH\/V\ufffd?~f\ufffdG\ufffdov\ufffdV\ufffd\ufffd\ufffd\ufffdHO \ufffdE\ufffd\ufffdON_0G3$\ufffdGz\ufffdF\ufffd Y\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd*x\ufffd\ufffd\ufffd\ufffd\ufffdsH\/V\ufffd?~f\ufffdG\ufffdov\ufffdV\u0000\ufffd\ufffd\ufffd\ufffdHO \ufffdE\ufffd\ufffdON_0\u0001G3$\ufffdG\u001az\ufffdF\ufffd\u001a Y\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\u0005\u001d\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd*x\ufffd\ufffd\ufffd\ufffd\ufffdsH\/V\ufffd?~f\ufffdG\ufffdov\ufffdV\ufffd\ufffd\ufffd\ufffdHO \ufffdE\ufffd\ufffdON_0G3$\ufffdGz\ufffdF\ufffd Y\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� �����t��(�7��WU@���� c�2�J9 4�Ε`gU7�����k�,d/:��pc��V�g9\ &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �����t��(�7��WU@���� c�2�J9 4�Ε`gU7�����k�,d/:��pc��V�g9\ &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �����t��(�7��WU@���� c�2�J9 4�Ε`gU7�����k�,d/:��pc��V�g9\ &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �6� l~{� �ǘ��*tᦠ+����y��g�p
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.8276319436045485,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "497808460f223e880c1a7f97572429ef",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd(\u001b\ufffd7\ufffd\ufffdWU@\ufffd\ufffd\ufffd\ufffd c\ufffd\u00172\ufffdJ9\u0016\u0011 4\ufffd\u0395`gU7\u001b\ufffd\ufffd\ufffd\u0007\ufffd\ufffdk\ufffd,d\/:\ufffd\ufffdpc\ufffd\ufffdV\ufffdg9\\\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd(\u001b\ufffd7\ufffd\ufffdWU@\ufffd\ufffd\ufffd\ufffd c\ufffd\u00172\ufffdJ9\u0016\u0011 4\ufffd\u0395`gU7\u001b\ufffd\ufffd\ufffd\u0007\ufffd\ufffdk\ufffd,d\/:\ufffd\ufffdpc\ufffd\ufffdV\ufffdg9\\\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd6\ufffd\nl~{\ufffd\n\ufffd\u01d8\ufffd\ufffd*t\u0007\u19a0\b+\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffdg\ufffdp",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd(\u001b\ufffd7\ufffd\ufffdWU@\ufffd\ufffd\ufffd\ufffd c\ufffd\u00172\ufffdJ9\u0016\u0011 4\ufffd\u0395`gU7\u001b\ufffd\ufffd\ufffd\u0007\ufffd\ufffdk\ufffd,d\/:\ufffd\ufffdpc\ufffd\ufffdV\ufffdg9\\\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dbef88fe2fa3e908d9ecba889f2d2a94242c7340",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd(\u001b\ufffd7\ufffd\ufffdWU@\ufffd\ufffd\ufffd\ufffd c\ufffd\u00172\ufffdJ9\u0016\u0011 4\ufffd\u0395`gU7\u001b\ufffd\ufffd\ufffd\u0007\ufffd\ufffdk\ufffd,d\/:\ufffd\ufffdpc\ufffd\ufffdV\ufffdg9\\\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd(\ufffd7\ufffd\ufffdWU@\ufffd\ufffd\ufffd\ufffd c\ufffd2\ufffdJ9 4\ufffd\u0395`gU7\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffd,d\/:\ufffd\ufffdpc\ufffd\ufffdV\ufffdg9\\&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd(\u001b\ufffd7\ufffd\ufffdWU@\ufffd\ufffd\ufffd\ufffd c\ufffd\u00172\ufffdJ9\u0016\u0011 4\ufffd\u0395`gU7\u001b\ufffd\ufffd\ufffd\u0007\ufffd\ufffdk\ufffd,d\/:\ufffd\ufffdpc\ufffd\ufffdV\ufffdg9\\\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd(\ufffd7\ufffd\ufffdWU@\ufffd\ufffd\ufffd\ufffd c\ufffd2\ufffdJ9 4\ufffd\u0395`gU7\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffd,d\/:\ufffd\ufffdpc\ufffd\ufffdV\ufffdg9\\&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� ���������y����1w�7J|�� #4 ��+�0�ڼ߆[���S���Y�Y��I���#� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���������y����1w�7J|�� #4 ��+�0�ڼ߆[���S���Y�Y��I���#� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ���������y����1w�7J|�� #4 ��+�0�ڼ߆[���S���Y�Y��I���#� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �ޯfC��] W�4Z �_�AO�N(��S}�f
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.801141237223726,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3da5332afe0309985659a0267d0f64cb",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006\u0006\u0007\ufffd\ufffd\u0011\ufffd\u0012\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd1\u0018w\ufffd7J\u0004|\ufffd\ufffd\u000b\u0006#4 \u0001\ufffd\ufffd+\ufffd0\ufffd\u06bc\u07c6\u000e[\ufffd\ufffd\ufffdS\ufffd\ufffd\ufffdY\ufffdY\ufffd\ufffdI\ufffd\ufffd\ufffd#\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006\u0006\u0007\ufffd\ufffd\u0011\ufffd\u0012\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd1\u0018w\ufffd7J\u0004|\ufffd\ufffd\u000b\u0006#4 \u0001\ufffd\ufffd+\ufffd0\ufffd\u06bc\u07c6\u000e[\ufffd\ufffd\ufffdS\ufffd\ufffd\ufffdY\ufffdY\ufffd\ufffdI\ufffd\ufffd\ufffd#\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u07affC\ufffd\ufffd]\fW\ufffd\u00184Z\u000b\ufffd\u000e_\ufffdAO\ufffdN(\ufffd\ufffdS}\u001a\ufffdf",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006\u0006\u0007\ufffd\ufffd\u0011\ufffd\u0012\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd1\u0018w\ufffd7J\u0004|\ufffd\ufffd\u000b\u0006#4 \u0001\ufffd\ufffd+\ufffd0\ufffd\u06bc\u07c6\u000e[\ufffd\ufffd\ufffdS\ufffd\ufffd\ufffdY\ufffdY\ufffd\ufffdI\ufffd\ufffd\ufffd#\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ae8e09ea3254fc9a2c02746e272145aaac5a80df",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006\u0006\u0007\ufffd\ufffd\u0011\ufffd\u0012\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd1\u0018w\ufffd7J\u0004|\ufffd\ufffd\u000b\u0006#4 \u0001\ufffd\ufffd+\ufffd0\ufffd\u06bc\u07c6\u000e[\ufffd\ufffd\ufffdS\ufffd\ufffd\ufffdY\ufffdY\ufffd\ufffdI\ufffd\ufffd\ufffd#\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd1w\ufffd7J|\ufffd\ufffd#4 \ufffd\ufffd+\ufffd0\ufffd\u06bc\u07c6[\ufffd\ufffd\ufffdS\ufffd\ufffd\ufffdY\ufffdY\ufffd\ufffdI\ufffd\ufffd\ufffd#\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006\u0006\u0007\ufffd\ufffd\u0011\ufffd\u0012\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd1\u0018w\ufffd7J\u0004|\ufffd\ufffd\u000b\u0006#4 \u0001\ufffd\ufffd+\ufffd0\ufffd\u06bc\u07c6\u000e[\ufffd\ufffd\ufffdS\ufffd\ufffd\ufffdY\ufffdY\ufffd\ufffdI\ufffd\ufffd\ufffd#\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffd1w\ufffd7J|\ufffd\ufffd#4 \ufffd\ufffd+\ufffd0\ufffd\u06bc\u07c6[\ufffd\ufffd\ufffdS\ufffd\ufffd\ufffdY\ufffdY\ufffd\ufffdI\ufffd\ufffd\ufffd#\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� ��;�f�ӈF#�/:E_Z�S�m��� �Nɪ �2 �S��&�E �!����~�I[F:�ѕ�cki &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��;�f�ӈF#�/:E_Z�S�m��� �Nɪ �2 �S��&�E �!����~�I[F:�ѕ�cki &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ��;�f�ӈF#�/:E_Z�S�m��� �Nɪ �2 �S��&�E �!����~�I[F:�ѕ�cki &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ ��8|6 o7 k-k� ���s>�� ���M
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.891526924194222,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b4aedbbe712cb961a25113cc0a30c1c9",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0016\ufffd;\ufffdf\ufffd\u04c8F#\ufffd\/\u0005:E_Z\ufffdS\ufffdm\u03a2\ufffd\ufffd\ufffd\t\ufffdN\u026a \u0000\ufffd2\u000b\ufffdS\ufffd\ufffd&\ufffdE\t\ufffd!\ufffd\ufffd\ufffd\ufffd~\ufffdI[F:\ufffd\b\u0455\ufffdcki\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0016\ufffd;\ufffdf\ufffd\u04c8F#\ufffd\/\u0005:E_Z\ufffdS\ufffdm\u03a2\ufffd\ufffd\ufffd\t\ufffdN\u026a \u0000\ufffd2\u000b\ufffdS\ufffd\ufffd&\ufffdE\t\ufffd!\ufffd\ufffd\ufffd\ufffd~\ufffdI[F:\ufffd\b\u0455\ufffdcki\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u001d\ufffd\ufffd8|6\u001eo7\u001ck-k\ufffd\u0018\f\ufffd\ufffd\ufffds>\ufffd\ufffd\u001b\f\ufffd\ufffd\u0018\ufffdM",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0016\ufffd;\ufffdf\ufffd\u04c8F#\ufffd\/\u0005:E_Z\ufffdS\ufffdm\u03a2\ufffd\ufffd\ufffd\t\ufffdN\u026a \u0000\ufffd2\u000b\ufffdS\ufffd\ufffd&\ufffdE\t\ufffd!\ufffd\ufffd\ufffd\ufffd~\ufffdI[F:\ufffd\b\u0455\ufffdcki\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5ef3878c3aac1cfd4d390200d0f5e80dc95a96e0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0016\ufffd;\ufffdf\ufffd\u04c8F#\ufffd\/\u0005:E_Z\ufffdS\ufffdm\u03a2\ufffd\ufffd\ufffd\t\ufffdN\u026a \u0000\ufffd2\u000b\ufffdS\ufffd\ufffd&\ufffdE\t\ufffd!\ufffd\ufffd\ufffd\ufffd~\ufffdI[F:\ufffd\b\u0455\ufffdcki\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd;\ufffdf\ufffd\u04c8F#\ufffd\/:E_Z\ufffdS\ufffdm\u03a2\ufffd\ufffd\ufffd\t\ufffdN\u026a \ufffd2\ufffdS\ufffd\ufffd&\ufffdE\t\ufffd!\ufffd\ufffd\ufffd\ufffd~\ufffdI[F:\ufffd\u0455\ufffdcki&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0016\ufffd;\ufffdf\ufffd\u04c8F#\ufffd\/\u0005:E_Z\ufffdS\ufffdm\u03a2\ufffd\ufffd\ufffd\t\ufffdN\u026a \u0000\ufffd2\u000b\ufffdS\ufffd\ufffd&\ufffdE\t\ufffd!\ufffd\ufffd\ufffd\ufffd~\ufffdI[F:\ufffd\b\u0455\ufffdcki\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd;\ufffdf\ufffd\u04c8F#\ufffd\/:E_Z\ufffdS\ufffdm\u03a2\ufffd\ufffd\ufffd\t\ufffdN\u026a \ufffd2\ufffdS\ufffd\ufffd&\ufffdE\t\ufffd!\ufffd\ufffd\ufffd\ufffd~\ufffdI[F:\ufffd\u0455\ufffdcki&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� ��Z��z��b]eb/��@d���% .�������� zЃ�d�� 3:� �?�(�7.�<�N� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��Z��z��b]eb/��@d���% .�������� zЃ�d��
3:� �?�(�7.�<�N� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ��Z��z��b]eb/��@d���% .�������� zЃ�d�� 3:� �?�(�7.�<�N� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ ��h�l� »>V �B�i=[0NnQ��P�y
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.861648107339034,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8b4a135cd822c132bb76f0af0d58b91a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdZ\ufffd\ufffdz\ufffd\ufffdb]eb\u0019\/\ufffd\ufffd@d\u0011\ufffd\ufffd\ufffd%\t.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \u0019z\u0403\ufffdd\ufffd\u0083\ufffd\r3:\ufffd\f\u001c\ufffd?\u0006\ufffd\u0012(\ufffd7.\u0014\ufffd<\ufffdN\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdZ\ufffd\ufffdz\ufffd\ufffdb]eb\u0019\/\ufffd\ufffd@d\u0011\ufffd\ufffd\ufffd%\t.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \u0019z\u0403\ufffdd\ufffd\u0083\ufffd\r3:\ufffd\f\u001c\ufffd?\u0006\ufffd\u0012(\ufffd7.\u0014\ufffd<\ufffdN\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdh\ufffdl\ufffd\u000b\u00bb>V\u001f\ufffdB\u000f\ufffd\u001b\u0019i=[0N\u0002nQ\ufffd\ufffdP\ufffdy",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdZ\ufffd\ufffdz\ufffd\ufffdb]eb\u0019\/\ufffd\ufffd@d\u0011\ufffd\ufffd\ufffd%\t.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \u0019z\u0403\ufffdd\ufffd\u0083\ufffd\r3:\ufffd\f\u001c\ufffd?\u0006\ufffd\u0012(\ufffd7.\u0014\ufffd<\ufffdN\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7357a7e4bffa1550f0cb8abf242af0ad5cc85240",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdZ\ufffd\ufffdz\ufffd\ufffdb]eb\u0019\/\ufffd\ufffd@d\u0011\ufffd\ufffd\ufffd%\t.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \u0019z\u0403\ufffdd\ufffd\u0083\ufffd\r3:\ufffd\f\u001c\ufffd?\u0006\ufffd\u0012(\ufffd7.\u0014\ufffd<\ufffdN\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffdZ\ufffd\ufffdz\ufffd\ufffdb]eb\/\ufffd\ufffd@d\ufffd\ufffd\ufffd%\t.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd z\u0403\ufffdd\ufffd\u0083\ufffd\r3:\ufffd\ufffd?\ufffd(\ufffd7.\ufffd<\ufffdN\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdZ\ufffd\ufffdz\ufffd\ufffdb]eb\u0019\/\ufffd\ufffd@d\u0011\ufffd\ufffd\ufffd%\t.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \u0019z\u0403\ufffdd\ufffd\u0083\ufffd\r3:\ufffd\f\u001c\ufffd?\u0006\ufffd\u0012(\ufffd7.\u0014\ufffd<\ufffdN\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdZ\ufffd\ufffdz\ufffd\ufffdb]eb\/\ufffd\ufffd@d\ufffd\ufffd\ufffd%\t.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd z\u0403\ufffdd\ufffd\u0083\ufffd\r3:\ufffd\ufffd?\ufffd(\ufffd7.\ufffd<\ufffdN\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� �� � �T��Y���1��d�Ћ�Y��,B�j�nS� ����3�2���\!�Qs�+G� C+�#WM�� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �� � �T��Y���1��d�Ћ�Y��,B�j�nS� ����3�2���\!�Qs�+G�
C+�#WM�� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �� � �T��Y���1��d�Ћ�Y��,B�j�nS� ����3�2���\!�Qs�+G� C+�#WM�� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ ��cs���x]U8��}uGخ=V��o�7�wSE
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.866942662209215,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "31ab7c77a69f3552784001cff1ec7497",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001f\ufffd\u001f\ufffdT\ufffd\ufffdY\ufffd\ufffd\ufffd1\ufffd\ufffdd\ufffd\u040b\ufffdY\ufffd\u0016\ufffd,B\ufffdj\ufffdnS\ufffd \ufffd\ufffd\ufffd\ufffd3\ufffd2\ufffd\ufffd\ufffd\u0004\\!\ufffdQs\ufffd+G\u0010\ufffd\u000e\nC+\ufffd#WM\u0014\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001f\ufffd\u001f\ufffdT\ufffd\ufffdY\ufffd\ufffd\ufffd1\ufffd\ufffdd\ufffd\u040b\ufffdY\ufffd\u0016\ufffd,B\ufffdj\ufffdnS\ufffd \ufffd\ufffd\ufffd\ufffd3\ufffd2\ufffd\ufffd\ufffd\u0004\\!\ufffdQs\ufffd+G\u0010\ufffd\u000e\nC+\ufffd#WM\u0014\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdcs\ufffd\ufffd\u0017\ufffdx]U8\ufffd\ufffd}\u0016uG\u062e=V\ufffd\ufffdo\ufffd7\ufffdwSE",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001f\ufffd\u001f\ufffdT\ufffd\ufffdY\ufffd\ufffd\ufffd1\ufffd\ufffdd\ufffd\u040b\ufffdY\ufffd\u0016\ufffd,B\ufffdj\ufffdnS\ufffd \ufffd\ufffd\ufffd\ufffd3\ufffd2\ufffd\ufffd\ufffd\u0004\\!\ufffdQs\ufffd+G\u0010\ufffd\u000e\nC+\ufffd#WM\u0014\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ab305e01cdb027ff8fcb7a0f0a4db46b7d41ca5f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001f\ufffd\u001f\ufffdT\ufffd\ufffdY\ufffd\ufffd\ufffd1\ufffd\ufffdd\ufffd\u040b\ufffdY\ufffd\u0016\ufffd,B\ufffdj\ufffdnS\ufffd \ufffd\ufffd\ufffd\ufffd3\ufffd2\ufffd\ufffd\ufffd\u0004\\!\ufffdQs\ufffd+G\u0010\ufffd\u000e\nC+\ufffd#WM\u0014\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffdY\ufffd\ufffd\ufffd1\ufffd\ufffdd\ufffd\u040b\ufffdY\ufffd\ufffd,B\ufffdj\ufffdnS\ufffd \ufffd\ufffd\ufffd\ufffd3\ufffd2\ufffd\ufffd\ufffd\\!\ufffdQs\ufffd+G\ufffd\nC+\ufffd#WM\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001f\ufffd\u001f\ufffdT\ufffd\ufffdY\ufffd\ufffd\ufffd1\ufffd\ufffdd\ufffd\u040b\ufffdY\ufffd\u0016\ufffd,B\ufffdj\ufffdnS\ufffd \ufffd\ufffd\ufffd\ufffd3\ufffd2\ufffd\ufffd\ufffd\u0004\\!\ufffdQs\ufffd+G\u0010\ufffd\u000e\nC+\ufffd#WM\u0014\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffdY\ufffd\ufffd\ufffd1\ufffd\ufffdd\ufffd\u040b\ufffdY\ufffd\ufffd,B\ufffdj\ufffdnS\ufffd \ufffd\ufffd\ufffd\ufffd3\ufffd2\ufffd\ufffd\ufffd\\!\ufffdQs\ufffd+G\ufffd\nC+\ufffd#WM\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� �X�&���? w����ϑ@ �7?[>�*hb�� �4@�tKGЩ� >��Qv7�-q�F)�n��Dʚ�� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �X�&���?
w����ϑ@ �7?[>�*hb�� �4@�tKGЩ� >��Qv7�-q�F)�n��Dʚ�� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �X�&���? w����ϑ@ �7?[>�*hb�� �4@�tKGЩ� >��Qv7�-q�F)�n��Dʚ�� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ z�9� � ^�k��u��"�b�+�������
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.794781669986877,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4fa89f5e95a4ac941790f35e3d3838b7",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X\ufffd&\ufffd\ufffd\ufffd\u0019?\nw\ufffd\u0006\ufffd\ufffd\ufffd\u03d1@ \ufffd7?[>\ufffd*\u0007hb\u0005\ufffd\ufffd \ufffd4@\ufffdtKG\u0429\ufffd\u001d>\ufffd\ufffdQv7\ufffd-q\ufffdF)\ufffdn\ufffd\ufffdD\u029a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X\ufffd&\ufffd\ufffd\ufffd\u0019?\nw\ufffd\u0006\ufffd\ufffd\ufffd\u03d1@ \ufffd7?[>\ufffd*\u0007hb\u0005\ufffd\ufffd \ufffd4@\ufffdtKG\u0429\ufffd\u001d>\ufffd\ufffdQv7\ufffd-q\ufffdF)\ufffdn\ufffd\ufffdD\u029a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 z\ufffd9\u0013\ufffd\u000b\ufffd\u001d^\u0016\ufffdk\ufffd\ufffdu\ufffd\ufffd\u0012\"\ufffdb\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\n\f",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X\ufffd&\ufffd\ufffd\ufffd\u0019?\nw\ufffd\u0006\ufffd\ufffd\ufffd\u03d1@ \ufffd7?[>\ufffd*\u0007hb\u0005\ufffd\ufffd \ufffd4@\ufffdtKG\u0429\ufffd\u001d>\ufffd\ufffdQv7\ufffd-q\ufffdF)\ufffdn\ufffd\ufffdD\u029a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "796d616c70f86d816bc8e2cadc1f124f7ff78fcd",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X\ufffd&\ufffd\ufffd\ufffd\u0019?\nw\ufffd\u0006\ufffd\ufffd\ufffd\u03d1@ \ufffd7?[>\ufffd*\u0007hb\u0005\ufffd\ufffd \ufffd4@\ufffdtKG\u0429\ufffd\u001d>\ufffd\ufffdQv7\ufffd-q\ufffdF)\ufffdn\ufffd\ufffdD\u029a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffdX\ufffd&\ufffd\ufffd\ufffd?\nw\ufffd\ufffd\ufffd\ufffd\u03d1@ \ufffd7?[>\ufffd*hb\ufffd\ufffd \ufffd4@\ufffdtKG\u0429\ufffd>\ufffd\ufffdQv7\ufffd-q\ufffdF)\ufffdn\ufffd\ufffdD\u029a\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X\ufffd&\ufffd\ufffd\ufffd\u0019?\nw\ufffd\u0006\ufffd\ufffd\ufffd\u03d1@ \ufffd7?[>\ufffd*\u0007hb\u0005\ufffd\ufffd \ufffd4@\ufffdtKG\u0429\ufffd\u001d>\ufffd\ufffdQv7\ufffd-q\ufffdF)\ufffdn\ufffd\ufffdD\u029a\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdX\ufffd&\ufffd\ufffd\ufffd?\nw\ufffd\ufffd\ufffd\ufffd\u03d1@ \ufffd7?[>\ufffd*hb\ufffd\ufffd \ufffd4@\ufffdtKG\u0429\ufffd>\ufffd\ufffdQv7\ufffd-q\ufffdF)\ufffdn\ufffd\ufffdD\u029a\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� �-PH* PL�J�I���cw:]�ܶ��H �� j��=U0f�9 "=��Y(tg�^込xX �P� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �-PH*
PL�J�I���cw:]�ܶ��H �� j��=U0f�9 "=��Y(tg�^込xX �P� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �-PH* PL�J�I���cw:]�ܶ��H �� j��=U0f�9 "=��Y(tg�^込xX �P� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ ,�iB�����_/!)�]���G0 �s*V��b
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.889747636564371,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dbed06c4df4ed47f09eda9da4e91482a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u05ee-PH*\rPL\ufffd\u0006\u000fJ\ufffdI\ufffd\ufffd\ufffd\u0006cw:]\ufffd\u0736\ufffd\ufffdH \ufffd\ufffd j\u000e\ufffd\ufffd=U0f\ufffd9\u001e\"=\ufffd\u0002\ufffdY(tg\ufffd\u000e^\u8fbcxX\u001f\ufffdP\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u05ee-PH*\rPL\ufffd\u0006\u000fJ\ufffdI\ufffd\ufffd\ufffd\u0006cw:]\ufffd\u0736\ufffd\ufffdH \ufffd\ufffd j\u000e\ufffd\ufffd=U0f\ufffd9\u001e\"=\ufffd\u0002\ufffdY(tg\ufffd\u000e^\u8fbcxX\u001f\ufffdP\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \t,\ufffdiB\ufffd\ufffd\ufffd\ufffd\ufffd_\/!)\ufffd]\ufffd\ufffd\ufffdG0\u0014\u000b\ufffds\u0013*V\ufffd\ufffdb",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u05ee-PH*\rPL\ufffd\u0006\u000fJ\ufffdI\ufffd\ufffd\ufffd\u0006cw:]\ufffd\u0736\ufffd\ufffdH \ufffd\ufffd j\u000e\ufffd\ufffd=U0f\ufffd9\u001e\"=\ufffd\u0002\ufffdY(tg\ufffd\u000e^\u8fbcxX\u001f\ufffdP\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "34c10e8a0ce549619928fa745607a3f3dedd2c2c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u05ee-PH*\rPL\ufffd\u0006\u000fJ\ufffdI\ufffd\ufffd\ufffd\u0006cw:]\ufffd\u0736\ufffd\ufffdH \ufffd\ufffd j\u000e\ufffd\ufffd=U0f\ufffd9\u001e\"=\ufffd\u0002\ufffdY(tg\ufffd\u000e^\u8fbcxX\u001f\ufffdP\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\u05ee-PH*\rPL\ufffdJ\ufffdI\ufffd\ufffd\ufffdcw:]\ufffd\u0736\ufffd\ufffdH \ufffd\ufffd j\ufffd\ufffd=U0f\ufffd9\"=\ufffd\ufffdY(tg\ufffd^\u8fbcxX\ufffdP\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u05ee-PH*\rPL\ufffd\u0006\u000fJ\ufffdI\ufffd\ufffd\ufffd\u0006cw:]\ufffd\u0736\ufffd\ufffdH \ufffd\ufffd j\u000e\ufffd\ufffd=U0f\ufffd9\u001e\"=\ufffd\u0002\ufffdY(tg\ufffd\u000e^\u8fbcxX\u001f\ufffdP\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u05ee-PH*\rPL\ufffdJ\ufffdI\ufffd\ufffd\ufffdcw:]\ufffd\u0736\ufffd\ufffdH \ufffd\ufffd j\ufffd\ufffd=U0f\ufffd9\"=\ufffd\ufffdY(tg\ufffd^\u8fbcxX\ufffdP\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� ��K����0�VLD}1����-\%��ۭ��H!` s@�/"1�� &,��k -]�;�@�vT.~�, &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��K����0�VLD}1����-\%��ۭ��H!` s@�/"1��
&,��k -]�;�@�vT.~�, &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ��K����0�VLD}1����-\%��ۭ��H!` s@�/"1�� &,��k -]�;�@�vT.~�, &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ ��~!� P# �2>*m,�RT*|k�)���Du
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.891097778809701,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dfaa2da083f125969f30968c8bd4e7f6",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\ufffd\ufffd\ufffd0\ufffdVLD}1\ufffd\u000e\ufffd\ufffd\ufffd-\\%\u0011\ufffd\u0004\ufffd\u06ed\ufffd\ufffdH!` s@\ufffd\/\"1\ufffd\ufffd\n&,\ufffd\ufffdk\u001e\u0013\u0006\u001f-]\ufffd;\ufffd@\ufffdvT.\u0004~\ufffd,\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\ufffd\ufffd\ufffd0\ufffdVLD}1\ufffd\u000e\ufffd\ufffd\ufffd-\\%\u0011\ufffd\u0004\ufffd\u06ed\ufffd\ufffdH!` s@\ufffd\/\"1\ufffd\ufffd\n&,\ufffd\ufffdk\u001e\u0013\u0006\u001f-]\ufffd;\ufffd@\ufffdvT.\u0004~\ufffd,\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd~!\ufffd\u000f P#\f\ufffd2>*m,\ufffdRT*|k\ufffd)\ufffd\ufffd\ufffdDu",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\ufffd\ufffd\ufffd0\ufffdVLD}1\ufffd\u000e\ufffd\ufffd\ufffd-\\%\u0011\ufffd\u0004\ufffd\u06ed\ufffd\ufffdH!` s@\ufffd\/\"1\ufffd\ufffd\n&,\ufffd\ufffdk\u001e\u0013\u0006\u001f-]\ufffd;\ufffd@\ufffdvT.\u0004~\ufffd,\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "08bb044a74e0198070366d457a572219db1db31f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\ufffd\ufffd\ufffd0\ufffdVLD}1\ufffd\u000e\ufffd\ufffd\ufffd-\\%\u0011\ufffd\u0004\ufffd\u06ed\ufffd\ufffdH!` s@\ufffd\/\"1\ufffd\ufffd\n&,\ufffd\ufffdk\u001e\u0013\u0006\u001f-]\ufffd;\ufffd@\ufffdvT.\u0004~\ufffd,\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffdK\ufffd\ufffd\ufffd\ufffd0\ufffdVLD}1\ufffd\ufffd\ufffd\ufffd-\\%\ufffd\ufffd\u06ed\ufffd\ufffdH!` s@\ufffd\/\"1\ufffd\ufffd\n&,\ufffd\ufffdk-]\ufffd;\ufffd@\ufffdvT.~\ufffd,&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\ufffd\ufffd\ufffd0\ufffdVLD}1\ufffd\u000e\ufffd\ufffd\ufffd-\\%\u0011\ufffd\u0004\ufffd\u06ed\ufffd\ufffdH!` s@\ufffd\/\"1\ufffd\ufffd\n&,\ufffd\ufffdk\u001e\u0013\u0006\u001f-]\ufffd;\ufffd@\ufffdvT.\u0004~\ufffd,\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdK\ufffd\ufffd\ufffd\ufffd0\ufffdVLD}1\ufffd\ufffd\ufffd\ufffd-\\%\ufffd\ufffd\u06ed\ufffd\ufffdH!` s@\ufffd\/\"1\ufffd\ufffd\n&,\ufffd\ufffdk-]\ufffd;\ufffd@\ufffdvT.~\ufffd,&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /app/.env.backup HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/53
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /app/.env.backup HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/53
Requête brute (extrait)
GET /app/.env.backup HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 256,
"payload_entropy": 5.376750690495461,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b8de3726fd5a7ae445c6d72ec818caf",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/app\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit\/53",
"request_sample": "GET \/app\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/61.0.3163.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/app\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit\/53",
"evidence": {
"request_sample": "GET \/app\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/61.0.3163.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/app\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit\/53",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b0370380b01f378f2c91f3c6fdc71475f7aefcbd",
"protocol_details": {
"payload_preview": "GET \/app\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit\/53",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/app\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit\/53",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/app\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit\/53",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/app\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit\/53",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /backend/.env.production HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko/2
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /backend/.env.production HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko/2
Requête brute (extrait)
GET /backend/.env.production HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Fennec/10.0.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 233,
"payload_entropy": 5.18830323478484,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1e28d818e65924bab0cdd1f281dc53b1",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/2",
"request_sample": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1 Fennec\/10.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/2",
"evidence": {
"request_sample": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1 Fennec\/10.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/2",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "344743243a2eff5017b8097c35a904e6f6263731",
"protocol_details": {
"payload_preview": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/2",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/2",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/2",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/backend\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/2",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /app/.env.prod HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Symbian/3; Series60/5.2 NokiaC6-01/011.010; Profile
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /app/.env.prod HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (Symbian/3; Series60/5.2 NokiaC6-01/011.010; Profile
Requête brute (extrait)
GET /app/.env.prod HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Symbian/3; Series60/5.2 NokiaC6-01/011.010; Profile/MIDP-2.1 Configuration/CLDC-1.1 ) AppleWebKit/525 (KHTML, like Gecko) Version/3.0 BrowserNG/7.2.7.2 3gpp-gba Accept-Charset: u
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 306,
"payload_entropy": 5.425713506373958,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a5b3cf7f4f91c4be3d83d00f7ad439a3",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/app\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Symbian\/3; Series60\/5.2 NokiaC6-01\/011.010; Profile",
"request_sample": "GET \/app\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Symbian\/3; Series60\/5.2 NokiaC6-01\/011.010; Profile\/MIDP-2.1 Configuration\/CLDC-1.1 ) AppleWebKit\/525 (KHTML, like Gecko) Version\/3.0 BrowserNG\/7.2.7.2 3gpp-gba\r\nAccept-Charset: u",
"payload_snippet": "GET \/app\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Symbian\/3; Series60\/5.2 NokiaC6-01\/011.010; Profile",
"evidence": {
"request_sample": "GET \/app\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Symbian\/3; Series60\/5.2 NokiaC6-01\/011.010; Profile\/MIDP-2.1 Configuration\/CLDC-1.1 ) AppleWebKit\/525 (KHTML, like Gecko) Version\/3.0 BrowserNG\/7.2.7.2 3gpp-gba\r\nAccept-Charset: u",
"payload_snippet": "GET \/app\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Symbian\/3; Series60\/5.2 NokiaC6-01\/011.010; Profile",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "09429a58e215103792db41353d623f14d2e3e7d8",
"protocol_details": {
"payload_preview": "GET \/app\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Symbian\/3; Series60\/5.2 NokiaC6-01\/011.010; Profile",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/app\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Symbian\/3; Series60\/5.2 NokiaC6-01\/011.010; Profile",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/app\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Symbian\/3; Series60\/5.2 NokiaC6-01\/011.010; Profile",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/app\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Symbian\/3; Series60\/5.2 NokiaC6-01\/011.010; Profile",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /app/.env.local HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Ge
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /app/.env.local HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Ge
Requête brute (extrait)
GET /app/.env.local HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 236,
"payload_entropy": 5.334321470303966,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b9be7a6d7a70554bd3a280340ea7cf91",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/app\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Ge",
"request_sample": "GET \/app\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/app\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Ge",
"evidence": {
"request_sample": "GET \/app\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/app\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Ge",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2cc845576ea85be954572d186091feba5c1405c0",
"protocol_details": {
"payload_preview": "GET \/app\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Ge",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/app\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Ge",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/app\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Ge",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/app\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Ge",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Faible · 34
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
net_flood
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /uat/.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: msnbot-media/1.1 ( http://search.msn.com/msnbot.htm) Accept-Charset:
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /uat/.env HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: msnbot-media/1.1 ( http://search.msn.com/msnbot.htm)
Accept-Charset:
Requête brute (extrait)
GET /uat/.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: msnbot-media/1.1 ( http://search.msn.com/msnbot.htm) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 180,
"payload_entropy": 5.056370143096997,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 34,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "4c534dfcbc4ff30ad0edf86865b3d75c7daa6ecf",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0e111182b31a38cb9cc655af1293b169",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 34
},
"payload_preview": "GET \/uat\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: msnbot-media\/1.1 ( http:\/\/search.msn.com\/msnbot.htm)\r\nAccept-Charset:",
"request_sample": "GET \/uat\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: msnbot-media\/1.1 ( http:\/\/search.msn.com\/msnbot.htm)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/uat\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: msnbot-media\/1.1 ( http:\/\/search.msn.com\/msnbot.htm)\r\nAccept-Charset:",
"evidence": {
"request_sample": "GET \/uat\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: msnbot-media\/1.1 ( http:\/\/search.msn.com\/msnbot.htm)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/uat\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: msnbot-media\/1.1 ( http:\/\/search.msn.com\/msnbot.htm)\r\nAccept-Charset:",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8cf56d5839b6d8f85d610027635a250106ad55e2",
"protocol_details": {
"payload_preview": "GET \/uat\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: msnbot-media\/1.1 ( http:\/\/search.msn.com\/msnbot.htm)\r\nAccept-Charset:",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/uat\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: msnbot-media\/1.1 ( http:\/\/search.msn.com\/msnbot.htm)\r\nAccept-Charset:",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 34\/100 (Faible) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 34
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/uat\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: msnbot-media\/1.1 ( http:\/\/search.msn.com\/msnbot.htm)\r\nAccept-Charset:",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/uat\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: msnbot-media\/1.1 ( http:\/\/search.msn.com\/msnbot.htm)\r\nAccept-Charset:",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� ��99�t%�E] 0ѕ�}���q���Y=ׅK�j� ß+�/8M8c=��<V)Q<�/���#Ưw��v &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��99�t%�E] 0ѕ�}���q���Y=ׅK�j� ß+�/8M8c=��<V)Q<�/���#Ưw��v &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ��99�t%�E] 0ѕ�}���q���Y=ׅK�j� ß+�/8M8c=��<V)Q<�/���#Ưw��v &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ ��FU���lk���ȍ� /��W&ePSK��F
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.84572291936621,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "45c15ec0512925b8385287385e1771a0",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd99\ufffdt%\ufffdE]\t0\u0014\u0455\ufffd\u0013}\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdY=\u05c5K\ufffdj\ufffd \u00df+\ufffd\/8M8c=\ufffd\ufffd<V)\u0013Q<\ufffd\/\u0004\ufffd\ufffd\u0016\ufffd#\u01afw\ufffd\ufffdv\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd99\ufffdt%\ufffdE]\t0\u0014\u0455\ufffd\u0013}\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdY=\u05c5K\ufffdj\ufffd \u00df+\ufffd\/8M8c=\ufffd\ufffd<V)\u0013Q<\ufffd\/\u0004\ufffd\ufffd\u0016\ufffd#\u01afw\ufffd\ufffdv\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u001b\ufffdFU\u001b\ufffd\u0001\ufffd\ufffdlk\ufffd\ufffd\u0006\ufffd\u020d\ufffd \/\ufffd\ufffdW&ePSK\ufffd\ufffdF",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd99\ufffdt%\ufffdE]\t0\u0014\u0455\ufffd\u0013}\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdY=\u05c5K\ufffdj\ufffd \u00df+\ufffd\/8M8c=\ufffd\ufffd<V)\u0013Q<\ufffd\/\u0004\ufffd\ufffd\u0016\ufffd#\u01afw\ufffd\ufffdv\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5159b5a2582e27027a7693b68ff5b39172e9ff78",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd99\ufffdt%\ufffdE]\t0\u0014\u0455\ufffd\u0013}\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdY=\u05c5K\ufffdj\ufffd \u00df+\ufffd\/8M8c=\ufffd\ufffd<V)\u0013Q<\ufffd\/\u0004\ufffd\ufffd\u0016\ufffd#\u01afw\ufffd\ufffdv\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd99\ufffdt%\ufffdE]\t0\u0455\ufffd}\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdY=\u05c5K\ufffdj\ufffd \u00df+\ufffd\/8M8c=\ufffd\ufffd<V)Q<\ufffd\/\ufffd\ufffd\ufffd#\u01afw\ufffd\ufffdv&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd99\ufffdt%\ufffdE]\t0\u0014\u0455\ufffd\u0013}\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdY=\u05c5K\ufffdj\ufffd \u00df+\ufffd\/8M8c=\ufffd\ufffd<V)\u0013Q<\ufffd\/\u0004\ufffd\ufffd\u0016\ufffd#\u01afw\ufffd\ufffdv\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd99\ufffdt%\ufffdE]\t0\u0455\ufffd}\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffdY=\u05c5K\ufffdj\ufffd \u00df+\ufffd\/8M8c=\ufffd\ufffd<V)Q<\ufffd\/\ufffd\ufffd\ufffd#\u01afw\ufffd\ufffdv&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� ��X#@�݂�G��e Z���Y�@F�c$� �� ���= I�3motd�� c�0f@^�Nz���� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��X#@�݂�G��e Z���Y�@F�c$� �� ���= I�3motd�� c�0f@^�Nz���� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ��X#@�݂�G��e Z���Y�@F�c$� �� ���= I�3motd�� c�0f@^�Nz���� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ mi#��:b%ȱߒ)�d�5�ȿ�k�J{� (n
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.7895409303554874,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "630b38b27c6033489a1b795b78ddd794",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX#@\ufffd\u0742\ufffdG\ufffd\ufffde\u0000\u0017Z\ufffd\ufffd\ufffdY\u0018\ufffd@F\ufffd\u0006c$\ufffd\u000b\ufffd\ufffd \ufffd\u0002\ufffd\ufffd=\u001cI\ufffd3motd\ufffd\ufffd\u001dc\u0012\ufffd0f@^\ufffdNz\ufffd\u0003\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX#@\ufffd\u0742\ufffdG\ufffd\ufffde\u0000\u0017Z\ufffd\ufffd\ufffdY\u0018\ufffd@F\ufffd\u0006c$\ufffd\u000b\ufffd\ufffd \ufffd\u0002\ufffd\ufffd=\u001cI\ufffd3motd\ufffd\ufffd\u001dc\u0012\ufffd0f@^\ufffdNz\ufffd\u0003\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 mi#\u0001\ufffd\ufffd:b%\u0231\u07d2)\ufffdd\ufffd5\ufffd\u023f\ufffdk\ufffdJ\u0014{\ufffd\u000b(n",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX#@\ufffd\u0742\ufffdG\ufffd\ufffde\u0000\u0017Z\ufffd\ufffd\ufffdY\u0018\ufffd@F\ufffd\u0006c$\ufffd\u000b\ufffd\ufffd \ufffd\u0002\ufffd\ufffd=\u001cI\ufffd3motd\ufffd\ufffd\u001dc\u0012\ufffd0f@^\ufffdNz\ufffd\u0003\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6e1188d62c2faa47ea722d198f5ad72e36495025",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX#@\ufffd\u0742\ufffdG\ufffd\ufffde\u0000\u0017Z\ufffd\ufffd\ufffdY\u0018\ufffd@F\ufffd\u0006c$\ufffd\u000b\ufffd\ufffd \ufffd\u0002\ufffd\ufffd=\u001cI\ufffd3motd\ufffd\ufffd\u001dc\u0012\ufffd0f@^\ufffdNz\ufffd\u0003\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffdX#@\ufffd\u0742\ufffdG\ufffd\ufffdeZ\ufffd\ufffd\ufffdY\ufffd@F\ufffdc$\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd=I\ufffd3motd\ufffd\ufffdc\ufffd0f@^\ufffdNz\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX#@\ufffd\u0742\ufffdG\ufffd\ufffde\u0000\u0017Z\ufffd\ufffd\ufffdY\u0018\ufffd@F\ufffd\u0006c$\ufffd\u000b\ufffd\ufffd \ufffd\u0002\ufffd\ufffd=\u001cI\ufffd3motd\ufffd\ufffd\u001dc\u0012\ufffd0f@^\ufffdNz\ufffd\u0003\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdX#@\ufffd\u0742\ufffdG\ufffd\ufffdeZ\ufffd\ufffd\ufffdY\ufffd@F\ufffdc$\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd=I\ufffd3motd\ufffd\ufffdc\ufffd0f@^\ufffdNz\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� ��1`�wR +>�����B�>��|���K�֡O@ ��c�C+1���m�xar��Z���&10%m�.� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��1`�wR +>�����B�>��|���K�֡O@ ��c�C+1���m�xar��Z���&10%m�.� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ��1`�wR +>�����B�>��|���K�֡O@ ��c�C+1���m�xar��Z���&10%m�.� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ Ѧ[^i�s�[�����HZ���<#���܄&Ǵp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.8179855379061305,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bb3421e3cd2f33198caee236ff5e7c74",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd1`\ufffdwR\u0000+>\ufffd\ufffd\ufffd\b\ufffd\u0019\ufffdB\ufffd>\ufffd\ufffd|\ufffd\ufffd\ufffdK\ufffd\u05a1O@ \ufffd\ufffdc\ufffdC+1\ufffd\ufffd\ufffdm\ufffdxar\ufffd\ufffdZ\ufffd\ufffd\u000e\ufffd&10%m\ufffd.\ufffd\u0017\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd1`\ufffdwR\u0000+>\ufffd\ufffd\ufffd\b\ufffd\u0019\ufffdB\ufffd>\ufffd\ufffd|\ufffd\ufffd\ufffdK\ufffd\u05a1O@ \ufffd\ufffdc\ufffdC+1\ufffd\ufffd\ufffdm\ufffdxar\ufffd\ufffdZ\ufffd\ufffd\u000e\ufffd&10%m\ufffd.\ufffd\u0017\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0466[^\u0005i\ufffds\ufffd[\ufffd\u0001\ufffd\ufffd\ufffd\ufffdHZ\ufffd\ufffd\ufffd<#\ufffd\ufffd\ufffd\u0704&\u01f4p",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd1`\ufffdwR\u0000+>\ufffd\ufffd\ufffd\b\ufffd\u0019\ufffdB\ufffd>\ufffd\ufffd|\ufffd\ufffd\ufffdK\ufffd\u05a1O@ \ufffd\ufffdc\ufffdC+1\ufffd\ufffd\ufffdm\ufffdxar\ufffd\ufffdZ\ufffd\ufffd\u000e\ufffd&10%m\ufffd.\ufffd\u0017\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "562a34c2f163b02c8ca7cce88ae68d0b297f525b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd1`\ufffdwR\u0000+>\ufffd\ufffd\ufffd\b\ufffd\u0019\ufffdB\ufffd>\ufffd\ufffd|\ufffd\ufffd\ufffdK\ufffd\u05a1O@ \ufffd\ufffdc\ufffdC+1\ufffd\ufffd\ufffdm\ufffdxar\ufffd\ufffdZ\ufffd\ufffd\u000e\ufffd&10%m\ufffd.\ufffd\u0017\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd1`\ufffdwR+>\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd>\ufffd\ufffd|\ufffd\ufffd\ufffdK\ufffd\u05a1O@ \ufffd\ufffdc\ufffdC+1\ufffd\ufffd\ufffdm\ufffdxar\ufffd\ufffdZ\ufffd\ufffd\ufffd&10%m\ufffd.\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd1`\ufffdwR\u0000+>\ufffd\ufffd\ufffd\b\ufffd\u0019\ufffdB\ufffd>\ufffd\ufffd|\ufffd\ufffd\ufffdK\ufffd\u05a1O@ \ufffd\ufffdc\ufffdC+1\ufffd\ufffd\ufffdm\ufffdxar\ufffd\ufffdZ\ufffd\ufffd\u000e\ufffd&10%m\ufffd.\ufffd\u0017\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd1`\ufffdwR+>\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd>\ufffd\ufffd|\ufffd\ufffd\ufffdK\ufffd\u05a1O@ \ufffd\ufffdc\ufffdC+1\ufffd\ufffd\ufffdm\ufffdxar\ufffd\ufffdZ\ufffd\ufffd\ufffd&10%m\ufffd.\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /app/.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Linux; Android 9; RMX1851) AppleWebKit/537.36 (KHTML, li
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /app/.env HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (Linux; Android 9; RMX1851) AppleWebKit/537.36 (KHTML, li
Requête brute (extrait)
GET /app/.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Linux; Android 9; RMX1851) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 248,
"payload_entropy": 5.428458405773696,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f52efa1934f4ef4987713514bdb4f931",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1851) AppleWebKit\/537.36 (KHTML, li",
"request_sample": "GET \/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1851) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1851) AppleWebKit\/537.36 (KHTML, li",
"evidence": {
"request_sample": "GET \/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1851) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1851) AppleWebKit\/537.36 (KHTML, li",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2587d2496802b8120eca959cb01862da264e1288",
"protocol_details": {
"payload_preview": "GET \/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1851) AppleWebKit\/537.36 (KHTML, li",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1851) AppleWebKit\/537.36 (KHTML, li",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1851) AppleWebKit\/537.36 (KHTML, li",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; RMX1851) AppleWebKit\/537.36 (KHTML, li",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde Elasticsearch
elasticsearch probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 49
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /admin/.env.production HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 49
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0341
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ES admin GET
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /admin/.env.production HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/53
Requête brute (extrait)
GET /admin/.env.production HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3835.0 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 254,
"payload_entropy": 5.402896840876473,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 49,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0341"
],
"kb_rule_ids": [
"pat-0341"
],
"matched_patterns": [
"pat-0341"
],
"matched_pattern_names": [
"ES admin GET"
],
"pattern_ids": [
"pat-0341"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 49
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6abf4fe127837696ee9cf8b0e64b655b",
"path_pattern_hash": "9dbf5366f59d9174076d704198d3d3fd"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 49
},
"payload_preview": "GET \/admin\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"request_sample": "GET \/admin\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3835.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/admin\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"evidence": {
"request_sample": "GET \/admin\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/77.0.3835.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/admin\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8d9922549af77fe154a986d424a948d4df193e74",
"protocol_details": {
"payload_preview": "GET \/admin\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/admin\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"attack_vector": "elasticsearch probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 49\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 49
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0341"
],
"tags_summary_labels_fr": [
"pat-0341"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "GET \/admin\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "elasticsearch probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/admin\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/53",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /src/.env.backup HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/53
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /src/.env.backup HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/53
Requête brute (extrait)
GET /src/.env.backup HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.87 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 255,
"payload_entropy": 5.4133723058064165,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5e4e1205bc159266bc94e2c39b111f06",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/53",
"request_sample": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.87 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/53",
"evidence": {
"request_sample": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.87 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/53",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2369daf42d19746c72c9677a2cb51ac85d213d8",
"protocol_details": {
"payload_preview": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/53",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/53",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/53",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/src\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/53",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /server/.env.backup HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-N950F Build/PPR1.
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /server/.env.backup HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-N950F Build/PPR1.
Requête brute (extrait)
GET /server/.env.backup HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-N950F Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/9.4 Chrome/67.0.3396.87 Mobile Safari/537.36 Accept-Charset:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 307,
"payload_entropy": 5.53673289287392,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "39959192c75a52d2d8f021ea7f65566f",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/server\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-N950F Build\/PPR1.",
"request_sample": "GET \/server\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-N950F Build\/PPR1.180610.011) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36\r\nAccept-Charset: ",
"payload_snippet": "GET \/server\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-N950F Build\/PPR1.",
"evidence": {
"request_sample": "GET \/server\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-N950F Build\/PPR1.180610.011) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36\r\nAccept-Charset: ",
"payload_snippet": "GET \/server\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-N950F Build\/PPR1.",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3b6e5580f74ed1480f012e2118913e5609f254b3",
"protocol_details": {
"payload_preview": "GET \/server\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-N950F Build\/PPR1.",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/server\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-N950F Build\/PPR1.",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/server\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-N950F Build\/PPR1.",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/server\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-N950F Build\/PPR1.",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /services/.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, l
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /services/.env HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, l
Requête brute (extrait)
GET /services/.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 242,
"payload_entropy": 5.407208476807838,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "27611042b2caa846850577ff7a7f1de4",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/services\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHTML, l",
"request_sample": "GET \/services\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/services\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHTML, l",
"evidence": {
"request_sample": "GET \/services\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/services\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHTML, l",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9bd0f86dedfa264902ebdd0051cb4d5761eb3eda",
"protocol_details": {
"payload_preview": "GET \/services\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHTML, l",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/services\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHTML, l",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/services\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHTML, l",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/services\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KHTML, l",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde Elasticsearch
elasticsearch probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Faible · 33
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
net_flood
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /admin/.env.local HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: LG-LX550 AU-MIC-LX550/2.0 MMP/2.0 Profile/MIDP-2.0 Configurat
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 33
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0341
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ES admin GET
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /admin/.env.local HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: LG-LX550 AU-MIC-LX550/2.0 MMP/2.0 Profile/MIDP-2.0 Configurat
Requête brute (extrait)
GET /admin/.env.local HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: LG-LX550 AU-MIC-LX550/2.0 MMP/2.0 Profile/MIDP-2.0 Configuration/CLDC-1.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 209,
"payload_entropy": 5.248294043442154,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 33,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "0f22d3d03ed2592133d8266d34dad6c22eaf89eb",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0341"
],
"kb_rule_ids": [
"pat-0341"
],
"matched_patterns": [
"pat-0341"
],
"matched_pattern_names": [
"ES admin GET"
],
"pattern_ids": [
"pat-0341"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 33
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "042e3d7d23b75d3124ec87a733cd0e7d",
"path_pattern_hash": "9dbf5366f59d9174076d704198d3d3fd"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 33
},
"payload_preview": "GET \/admin\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: LG-LX550 AU-MIC-LX550\/2.0 MMP\/2.0 Profile\/MIDP-2.0 Configurat",
"request_sample": "GET \/admin\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: LG-LX550 AU-MIC-LX550\/2.0 MMP\/2.0 Profile\/MIDP-2.0 Configuration\/CLDC-1.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/admin\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: LG-LX550 AU-MIC-LX550\/2.0 MMP\/2.0 Profile\/MIDP-2.0 Configurat",
"evidence": {
"request_sample": "GET \/admin\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: LG-LX550 AU-MIC-LX550\/2.0 MMP\/2.0 Profile\/MIDP-2.0 Configuration\/CLDC-1.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/admin\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: LG-LX550 AU-MIC-LX550\/2.0 MMP\/2.0 Profile\/MIDP-2.0 Configurat",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5ee20b4ad3e117f9fd51ca7f71da95728f32a666",
"protocol_details": {
"payload_preview": "GET \/admin\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: LG-LX550 AU-MIC-LX550\/2.0 MMP\/2.0 Profile\/MIDP-2.0 Configurat",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/admin\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: LG-LX550 AU-MIC-LX550\/2.0 MMP\/2.0 Profile\/MIDP-2.0 Configurat",
"attack_vector": "elasticsearch probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 33
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0341"
],
"tags_summary_labels_fr": [
"pat-0341"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "GET \/admin\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: LG-LX550 AU-MIC-LX550\/2.0 MMP\/2.0 Profile\/MIDP-2.0 Configurat",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "elasticsearch probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/admin\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: LG-LX550 AU-MIC-LX550\/2.0 MMP\/2.0 Profile\/MIDP-2.0 Configurat",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"net_flood",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� �.�h#�0ũMN��&�$��?��q��p��o�� �����읗�o�T-���L` ������,� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �.�h#�0ũMN��&�$��?��q��p��o�� �����읗�o�T-���L` ������,� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �.�h#�0ũMN��&�$��?��q��p��o�� �����읗�o�T-���L` ������,� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ ��f��⛰@4�k���� 8f� n�S;�W��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.815105742158696,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f53079948a846a54580d3cbf5a9ba7ee",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffd\u0002h#\ufffd0\u0169\u001bMN\ufffd\ufffd&\ufffd$\ufffd\ufffd?\ufffd\u0011\ufffdq\ufffd\ufffdp\ufffd\ufffdo\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u0016\uc757\ufffdo\ufffdT-\ufffd\ufffd\ufffdL`\u001a\u001d\ufffd\ufffd\u0002\ufffd\ufffd\ufffd\ufffd,\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffd\u0002h#\ufffd0\u0169\u001bMN\ufffd\ufffd&\ufffd$\ufffd\ufffd?\ufffd\u0011\ufffdq\ufffd\ufffdp\ufffd\ufffdo\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u0016\uc757\ufffdo\ufffdT-\ufffd\ufffd\ufffdL`\u001a\u001d\ufffd\ufffd\u0002\ufffd\ufffd\ufffd\ufffd,\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdf\u0011\ufffd\ufffd\u26f0\u0005@4\ufffdk\ufffd\ufffd\ufffd\ufffd\u001c8f\ufffd\u0000n\ufffdS;\ufffdW\ufffd\ufffd\u0004",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffd\u0002h#\ufffd0\u0169\u001bMN\ufffd\ufffd&\ufffd$\ufffd\ufffd?\ufffd\u0011\ufffdq\ufffd\ufffdp\ufffd\ufffdo\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u0016\uc757\ufffdo\ufffdT-\ufffd\ufffd\ufffdL`\u001a\u001d\ufffd\ufffd\u0002\ufffd\ufffd\ufffd\ufffd,\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "042fa0bce150b8ff24cd53c82c9a61561a79bd0c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffd\u0002h#\ufffd0\u0169\u001bMN\ufffd\ufffd&\ufffd$\ufffd\ufffd?\ufffd\u0011\ufffdq\ufffd\ufffdp\ufffd\ufffdo\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u0016\uc757\ufffdo\ufffdT-\ufffd\ufffd\ufffdL`\u001a\u001d\ufffd\ufffd\u0002\ufffd\ufffd\ufffd\ufffd,\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd.\ufffdh#\ufffd0\u0169MN\ufffd\ufffd&\ufffd$\ufffd\ufffd?\ufffd\ufffdq\ufffd\ufffdp\ufffd\ufffdo\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\uc757\ufffdo\ufffdT-\ufffd\ufffd\ufffdL`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003.\ufffd\u0002h#\ufffd0\u0169\u001bMN\ufffd\ufffd&\ufffd$\ufffd\ufffd?\ufffd\u0011\ufffdq\ufffd\ufffdp\ufffd\ufffdo\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u0016\uc757\ufffdo\ufffdT-\ufffd\ufffd\ufffdL`\u001a\u001d\ufffd\ufffd\u0002\ufffd\ufffd\ufffd\ufffd,\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd.\ufffdh#\ufffd0\u0169MN\ufffd\ufffd&\ufffd$\ufffd\ufffd?\ufffd\ufffdq\ufffd\ufffdp\ufffd\ufffdo\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\uc757\ufffdo\ufffdT-\ufffd\ufffd\ufffdL`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Flood / DDoS
syn flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /conf/.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko)
Pourquoi cette classification : Type « syn_flood » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 43
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /conf/.env HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko)
Requête brute (extrait)
GET /conf/.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 246,
"payload_entropy": 5.363668774685513,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 79,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "58643189b2d00fe12cb6d1c1d785e5a1",
"path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 43
},
"payload_preview": "GET \/conf\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like Gecko)",
"request_sample": "GET \/conf\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/52.0.2743.116 Safari\/537.36 Edge\/15.15063\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/conf\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like Gecko)",
"evidence": {
"request_sample": "GET \/conf\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/52.0.2743.116 Safari\/537.36 Edge\/15.15063\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/conf\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like Gecko)",
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c237544fc53c7deb20d68ab6675f10e85e911014",
"protocol_details": {
"payload_preview": "GET \/conf\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like Gecko)",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/conf\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like Gecko)",
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab syn_flood \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 via HDFS NAMENODE",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 79,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/conf\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like Gecko)",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "syn flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/conf\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0) AppleWebKit\/537.36 (KHTML, like Gecko)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde Elasticsearch
elasticsearch probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 49
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
GET /admin/.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-gb) AppleWebKit/534.35 (KHTML,
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 49
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0341
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ES admin GET
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /admin/.env HTTP/1.1
Host: 62.3.50.33:8020
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-gb) AppleWebKit/534.35 (KHTML,
Requête brute (extrait)
GET /admin/.env HTTP/1.1 Host: 62.3.50.33:8020 User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-gb) AppleWebKit/534.35 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.35 Puffin/2.0.5603M Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 258,
"payload_entropy": 5.415975062209114,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 49,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25e80c7c0b4884fc729d9130b735ffc00ad5a6a9",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0341"
],
"kb_rule_ids": [
"pat-0341"
],
"matched_patterns": [
"pat-0341"
],
"matched_pattern_names": [
"ES admin GET"
],
"pattern_ids": [
"pat-0341"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 49
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ba187b3bafe84a3138b065e57fc9c240",
"path_pattern_hash": "9dbf5366f59d9174076d704198d3d3fd"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 49
},
"payload_preview": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-gb) AppleWebKit\/534.35 (KHTML, ",
"request_sample": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-gb) AppleWebKit\/534.35 (KHTML, like Gecko) Chrome\/11.0.696.65 Safari\/534.35 Puffin\/2.0.5603M\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n",
"payload_snippet": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-gb) AppleWebKit\/534.35 (KHTML,",
"evidence": {
"request_sample": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-gb) AppleWebKit\/534.35 (KHTML, like Gecko) Chrome\/11.0.696.65 Safari\/534.35 Puffin\/2.0.5603M\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n",
"payload_snippet": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-gb) AppleWebKit\/534.35 (KHTML,",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9175720695398acc70721456989549670e5ebb67",
"protocol_details": {
"payload_preview": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-gb) AppleWebKit\/534.35 (KHTML,",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-gb) AppleWebKit\/534.35 (KHTML,",
"attack_vector": "elasticsearch probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 49\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 49
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0341"
],
"tags_summary_labels_fr": [
"pat-0341"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-gb) AppleWebKit\/534.35 (KHTML,",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "elasticsearch probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8020\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; en-gb) AppleWebKit\/534.35 (KHTML,",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"http_get_probe",
"mozi_pattern",
"net_flood"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� �2n���d(�H�5�P�Q� ���L 羁Ԥ �! �?���҇�aS���TαD�P��FQ�s �S�fy &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �2n���d(�H�5�P�Q� ���L 羁Ԥ �! �?���҇�aS���TαD�P��FQ�s �S�fy &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� �2n���d(�H�5�P�Q� ���L 羁Ԥ �! �?���҇�aS���TαD�P��FQ�s �S�fy &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ )��tV�͢��W����>��i�n [��g-&
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.866767582795129,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ae976cb0dade715ca91e770de2236054",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00032n\ufffd\ufffd\ufffdd(\ufffdH\ufffd5\ufffdP\ufffdQ\ufffd\u001d\u001b\ufffd\ufffd\ufffdL\u001c\u7f81\b\u0524\u000b\ufffd! \ufffd?\ufffd\ufffd\ufffd\u0487\ufffdaS\ufffd\ufffd\ufffdT\u03b1D\ufffdP\ufffd\ufffdFQ\ufffds\u001c\u0012\ufffdS\ufffdfy\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00032n\ufffd\ufffd\ufffdd(\ufffdH\ufffd5\ufffdP\ufffdQ\ufffd\u001d\u001b\ufffd\ufffd\ufffdL\u001c\u7f81\b\u0524\u000b\ufffd! \ufffd?\ufffd\ufffd\ufffd\u0487\ufffdaS\ufffd\ufffd\ufffdT\u03b1D\ufffdP\ufffd\ufffdFQ\ufffds\u001c\u0012\ufffdS\ufffdfy\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 )\ufffd\ufffd\u0015tV\ufffd\u0362\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd>\ufffd\ufffdi\ufffdn\u001f[\ufffd\u0005\ufffdg\u0006-&",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00032n\ufffd\ufffd\ufffdd(\ufffdH\ufffd5\ufffdP\ufffdQ\ufffd\u001d\u001b\ufffd\ufffd\ufffdL\u001c\u7f81\b\u0524\u000b\ufffd! \ufffd?\ufffd\ufffd\ufffd\u0487\ufffdaS\ufffd\ufffd\ufffdT\u03b1D\ufffdP\ufffd\ufffdFQ\ufffds\u001c\u0012\ufffdS\ufffdfy\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d643974d870102179a1ea9776276f01dcd191e21",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00032n\ufffd\ufffd\ufffdd(\ufffdH\ufffd5\ufffdP\ufffdQ\ufffd\u001d\u001b\ufffd\ufffd\ufffdL\u001c\u7f81\b\u0524\u000b\ufffd! \ufffd?\ufffd\ufffd\ufffd\u0487\ufffdaS\ufffd\ufffd\ufffdT\u03b1D\ufffdP\ufffd\ufffdFQ\ufffds\u001c\u0012\ufffdS\ufffdfy\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd2n\ufffd\ufffd\ufffdd(\ufffdH\ufffd5\ufffdP\ufffdQ\ufffd\ufffd\ufffd\ufffdL\u7f81\u0524\ufffd! \ufffd?\ufffd\ufffd\ufffd\u0487\ufffdaS\ufffd\ufffd\ufffdT\u03b1D\ufffdP\ufffd\ufffdFQ\ufffds\ufffdS\ufffdfy&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00032n\ufffd\ufffd\ufffdd(\ufffdH\ufffd5\ufffdP\ufffdQ\ufffd\u001d\u001b\ufffd\ufffd\ufffdL\u001c\u7f81\b\u0524\u000b\ufffd! \ufffd?\ufffd\ufffd\ufffd\u0487\ufffdaS\ufffd\ufffd\ufffdT\u03b1D\ufffdP\ufffd\ufffdFQ\ufffds\u001c\u0012\ufffdS\ufffdfy\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd2n\ufffd\ufffd\ufffdd(\ufffdH\ufffd5\ufffdP\ufffdQ\ufffd\ufffd\ufffd\ufffdL\u7f81\u0524\ufffd! \ufffd?\ufffd\ufffd\ufffd\u0487\ufffdaS\ufffd\ufffd\ufffdT\u03b1D\ufffdP\ufffd\ufffdFQ\ufffds\ufffdS\ufffdfy&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� � �2xr�Cy,���H�k�OǼ��2�OjSb <��O��w半w��ؔ$R�: ��?�I^��~� &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �
�2xr�Cy,���H�k�OǼ��2�OjSb <��O��w半w��ؔ$R�: ��?�I^��~� &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� � �2xr�Cy,���H�k�OǼ��2�OjSb <��O��w半w��ؔ$R�: ��?�I^��~� &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �ID *�á*��� (�[lH'07�b��]�l
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.828150823382021,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "66f767b0035316b1dab07a3eee229677",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003 \n\ufffd2xr\ufffdCy,\ufffd\ufffd\ufffdH\u001b\ufffdk\ufffdO\u0019\u01fc\ufffd\u001b\ufffd2\ufffdOj\u0006Sb <\ufffd\ufffdO\ufffd\ufffdw\u534aw\ufffd\ufffd\u0614$R\ufffd:\u000b\u0006\ufffd\ufffd?\ufffdI^\ufffd\ufffd~\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003 \n\ufffd2xr\ufffdCy,\ufffd\ufffd\ufffdH\u001b\ufffdk\ufffdO\u0019\u01fc\ufffd\u001b\ufffd2\ufffdOj\u0006Sb <\ufffd\ufffdO\ufffd\ufffdw\u534aw\ufffd\ufffd\u0614$R\ufffd:\u000b\u0006\ufffd\ufffd?\ufffdI^\ufffd\ufffd~\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdI\u001aD\u001d*\ufffd\u00e1*\ufffd\ufffd\ufffd\u001e (\ufffd[\u0015lH'07\ufffdb\ufffd\ufffd]\ufffd\u0001l",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003 \n\ufffd2xr\ufffdCy,\ufffd\ufffd\ufffdH\u001b\ufffdk\ufffdO\u0019\u01fc\ufffd\u001b\ufffd2\ufffdOj\u0006Sb <\ufffd\ufffdO\ufffd\ufffdw\u534aw\ufffd\ufffd\u0614$R\ufffd:\u000b\u0006\ufffd\ufffd?\ufffdI^\ufffd\ufffd~\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "072798088d930cd48c2586ca69e236c3bcc35b0c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003 \n\ufffd2xr\ufffdCy,\ufffd\ufffd\ufffdH\u001b\ufffdk\ufffdO\u0019\u01fc\ufffd\u001b\ufffd2\ufffdOj\u0006Sb <\ufffd\ufffdO\ufffd\ufffdw\u534aw\ufffd\ufffd\u0614$R\ufffd:\u000b\u0006\ufffd\ufffd?\ufffdI^\ufffd\ufffd~\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd \n\ufffd2xr\ufffdCy,\ufffd\ufffd\ufffdH\ufffdk\ufffdO\u01fc\ufffd\ufffd2\ufffdOjSb <\ufffd\ufffdO\ufffd\ufffdw\u534aw\ufffd\ufffd\u0614$R\ufffd:\ufffd\ufffd?\ufffdI^\ufffd\ufffd~\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003 \n\ufffd2xr\ufffdCy,\ufffd\ufffd\ufffdH\u001b\ufffdk\ufffdO\u0019\u01fc\ufffd\u001b\ufffd2\ufffdOj\u0006Sb <\ufffd\ufffdO\ufffd\ufffdw\u534aw\ufffd\ufffd\u0614$R\ufffd:\u000b\u0006\ufffd\ufffd?\ufffdI^\ufffd\ufffd~\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd \n\ufffd2xr\ufffdCy,\ufffd\ufffd\ufffdH\ufffdk\ufffdO\u01fc\ufffd\ufffd2\ufffdOjSb <\ufffd\ufffdO\ufffd\ufffdw\u534aw\ufffd\ufffd\u0614$R\ufffd:\ufffd\ufffd?\ufffdI^\ufffd\ufffd~\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
14/06/2026 18:05:31 UTC
TCP
8020 · HDFS NAMENODE
Sonde PostgreSQL
postgres probe · via HDFS NAMENODE:8020 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 19e29534fd49dd27
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_flood
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
� ���������2�O �,������b���N j�i)������y��oÄ��j�Q��ٺi�0 &�+�/�,�0̨̩� �� � � � / 5� w
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���������2�O �,������b���N j�i)������y��oÄ��j�Q��ٺi�0 &�+�/�,�0̨̩� ��
� � � / 5�
w
Requête brute (extrait)
� ���������2�O �,������b���N j�i)������y��oÄ��j�Q��ٺi�0 &�+�/�,�0̨̩� �� � � � / 5� w � + 3 & $ �X�1����2bʞmP'n#W�T�B��� ��J�&
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 239,
"payload_entropy": 5.848421080315056,
"port_category": "registered",
"org": "Google LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 396982,
"country": "KR",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f3346b7371a1d5dc6588a3579e5bdadd9ec7851b",
"event_fingerprint": "004499a144c92e4455aac1722fd9719117630099",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "KR",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6dcf73cb6df98b173d0915ac472f1ed3",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "19e29534fd49dd27d09234e639c4057e",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\ufffd2\u0011\ufffd\u0012O\u001f\ufffd,\ufffd\u0012\u0013\ufffd\ufffd\ufffd\ufffd\u0002\ufffdb\ufffd\u0017\ufffd\ufffdN j\ufffdi)\b\ufffd\ufffd\ufffd\u0017\ufffd\ufffd\ufffdy\ufffd\ufffdo\u00c4\ufffd\ufffd\u0015j\ufffdQ\ufffd\ufffd\u067ai\ufffd0\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\ufffd2\u0011\ufffd\u0012O\u001f\ufffd,\ufffd\u0012\u0013\ufffd\ufffd\ufffd\ufffd\u0002\ufffdb\ufffd\u0017\ufffd\ufffdN j\ufffdi)\b\ufffd\ufffd\ufffd\u0017\ufffd\ufffd\ufffdy\ufffd\ufffdo\u00c4\ufffd\ufffd\u0015j\ufffdQ\ufffd\ufffd\u067ai\ufffd0\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdX\ufffd1\ufffd\ufffd\ufffd\ufffd2b\u029emP'n\b#W\ufffdT\ufffdB\ufffd\ufffd\ufffd\u001f\ufffd\ufffdJ\ufffd&",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\ufffd2\u0011\ufffd\u0012O\u001f\ufffd,\ufffd\u0012\u0013\ufffd\ufffd\ufffd\ufffd\u0002\ufffdb\ufffd\u0017\ufffd\ufffdN j\ufffdi)\b\ufffd\ufffd\ufffd\u0017\ufffd\ufffd\ufffdy\ufffd\ufffdo\u00c4\ufffd\ufffd\u0015j\ufffdQ\ufffd\ufffd\u067ai\ufffd0\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7cf91d2ba75d442b4e33c31e95441ceceb78071b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\ufffd2\u0011\ufffd\u0012O\u001f\ufffd,\ufffd\u0012\u0013\ufffd\ufffd\ufffd\ufffd\u0002\ufffdb\ufffd\u0017\ufffd\ufffdN j\ufffdi)\b\ufffd\ufffd\ufffd\u0017\ufffd\ufffd\ufffdy\ufffd\ufffdo\u00c4\ufffd\ufffd\u0015j\ufffdQ\ufffd\ufffd\u067ai\ufffd0\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2\ufffdO\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdN j\ufffdi)\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffdo\u00c4\ufffd\ufffdj\ufffdQ\ufffd\ufffd\u067ai\ufffd0&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\ufffd2\u0011\ufffd\u0012O\u001f\ufffd,\ufffd\u0012\u0013\ufffd\ufffd\ufffd\ufffd\u0002\ufffdb\ufffd\u0017\ufffd\ufffdN j\ufffdi)\b\ufffd\ufffd\ufffd\u0017\ufffd\ufffd\ufffdy\ufffd\ufffdo\u00c4\ufffd\ufffd\u0015j\ufffdQ\ufffd\ufffd\u067ai\ufffd0\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "19e29534fd49dd27d09234e639c4057e",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "postgres probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2\ufffdO\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdN j\ufffdi)\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffdo\u00c4\ufffd\ufffdj\ufffdQ\ufffd\ufffd\u067ai\ufffd0&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_flood",
"tls_clienthello"
],
"asn_dc_heuristic": true
}