Fiche IP

Belgique

34.76.160.254

Activité suspecte · risque 38/100

FAI Google LLC Première vue 15/10/2026 10:15 UTC Dernière vue 26/10/2026 16:24 UTC Risque Moyen

Période 2026-09-26 → 2026-10-26

Moyen 48/100

24h 7j 30j 90j

Synthèse

Score de risque max. 48/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 15/10/2026 10:15 UTC

Dernière observation 26/10/2026 16:24 UTC

Événements (période) 418

Décision conseillée Surveiller Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal TA0007 336 occurrences

Pourquoi listée

Type « Sonde port 9048/TCP » (signaux protocolaires) · confiance 55%

Confiance 55 % — Score WAF 32 · 2 tag(s) WAF

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

48/100 Confiance 55 % 418 événements TA0007

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 34.76.160.254
Décision : Investiguer
Score max : 48/100 (Moyen)
Confiance : 55 %
Période : 2026-09-26 → 2026-10-26 · 418 événements
Motif : Type « Sonde port 9048/TCP » (signaux protocolaires) · confiance 55%
MITRE : TA0007
FAI : Google LLC · Belgique

Comparaison ASN / FAI

ASN 396982 · 34.76.160.0/20 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 418 événements sur la période pour cette IP.

34.156.27.236 Tentative d'exploit 26/10/2026 15:35 UTC
34.76.226.40 Scan de ports 26/10/2026 12:48 UTC
34.156.114.126 Tentative d'exploit 26/10/2026 12:09 UTC
34.78.96.153 Tentative d'exploit 26/10/2026 12:08 UTC
162.216.150.25 SSRF 26/10/2026 11:32 UTC
35.203.210.54 SSRF 26/10/2026 11:24 UTC
146.148.10.171 SSRF 26/10/2026 10:51 UTC
34.62.56.159 Protocole wire MongoDB 26/10/2026 09:17 UTC

Événements (filtres)

418

Première observation

15/10/2026 10:15 UTC

Dernière observation

26/10/2026 16:24 UTC

Dernière activité (filtres)

26/10/2026 16:24 UTC

Événements 7j

355

Ports distincts (7j)

270

Classifications (7j)

256

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 351 MONGODB TCP 55 MYSQL TCP 3 ELASTICSEARCH TCP 1 POSTGRES TCP 1 HTTPS TCP 1 SMB TCP 1 FTP DATA TCP 1 SAP ICM TCP 1 I2P TCP 1 NFS TCP 1

HTTP

351

MONGODB

MYSQL

ELASTICSEARCH

POSTGRES

HTTPS

Géolocalisation

Origine réseau déclarée

Belgique unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Google LLC 0 Port 2049 Sonde NFS

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

port 9048 tcp · via HTTP:9048 · (sonde / probe)

Détails protocole

Méthode: GET
Chemin: /
User-Agent: python-requests/2.34.2

Aperçu payload

GET / HTTP/1.1 Host: 62.3.50.33:9048 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: */* Connecti

Port / service

9048 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Confiance

55%

Famille de menace

unknown IP signalée (IPsum, 3 listes ou plus)

MITRE ATT&CK — tactiques observées

Découverte Accès initial

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

418 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

418 événement(s) — page 2/17

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
26/10/2026 14:29:41 UTC	TCP	17010 · HTTP	http	Sonde port 17010/TCP port 17010 tcp · via HTTP:17010 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 17010 Chemin / cible / Preuve honeypot — Sonde port 17010/TCP Connexion détectée sur le port 17010 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 17010/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:17010 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connect Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:17010 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"d684a1f85412917cbf9f854b42b26a33d837e47b","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":147,"payload_entropy":5.121461141812314,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":17010,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":4.9,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"5475cb36719cd616a2b6c8af92e7c41ee2235930","event_fingerprint":"f4c3e882d4381733d431cc6a26a0523d472b98dc","classification_reason":"Type \u00ab port_17010_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"…
26/10/2026 14:29:28 UTC	TCP	2100 · HTTP	http	Sonde port 2100/TCP port 2100 tcp · via HTTP:2100 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2100 Chemin / cible / Preuve honeypot — Sonde port 2100/TCP Connexion détectée sur le port 2100 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 2100/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2100 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2100 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"75be1bfa36afbd295efe97e9ca6e16b96ea88292","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.097379032547585,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":2100,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":5.1,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"03e6b1c437b36e467625e17a60ae78c3bfbf82b1","event_fingerprint":"ccee5c434be797945d2055e80b1635521d633b48","classification_reason":"Type \u00ab port_2100_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
26/10/2026 14:22:18 UTC	TCP	12263 · HTTP	http	Sonde port 12263/TCP port 12263 tcp · via HTTP:12263 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12263 Chemin / cible / Preuve honeypot — Sonde port 12263/TCP Connexion détectée sur le port 12263 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 12263/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12263 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connect Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12263 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"439ae0937d2853a2ab28a5cafc116eb711cbdd23","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":147,"payload_entropy":5.0910911183653065,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":12263,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":4.3,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"7b1758b7b3a0cef1680272f4bf6931236962b89e","event_fingerprint":"a0c7f0158df5fa83a237f1bea5a245ba3c3dbda1","classification_reason":"Type \u00ab port_12263_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":…
26/10/2026 14:15:47 UTC	TCP	5251 · HTTP	http	Sonde port 5251/TCP port 5251 tcp · via HTTP:5251 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5251 Chemin / cible / Preuve honeypot — Sonde port 5251/TCP Connexion détectée sur le port 5251 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 5251/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5251 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5251 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"512723e8642d2ac62963c72620d0661a27c5890a","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.097379032547585,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":5251,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":3.3,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"75a8deb92974ce04854f80f2e1fc8b1705f57983","event_fingerprint":"44fbd66102dbc811ba286ea8a9eea85bd92b380b","classification_reason":"Type \u00ab port_5251_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
26/10/2026 12:59:49 UTC	TCP	4444 · I2P	i2p	Sonde I2P i2p probe · via I2P:4444 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Émulateur I2P WAF — Recommandation Surveiller Tags i2p_emulated i2p_payload net_i2p_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4444 Chemin / cible — Service I2P Payload +Ž')V��Y��y�ú?odj�^\sՕ >��e�Mq�#<-ϦzSV-�U�R�{M=H�,�0�+�/̨̩��̪��$�(�#�'� �� k Pourquoi cette classification :* Type « Sonde I2P » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 24 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) +Ž')V��Y��y�ú?odj�^\sՕ >��e�Mq�#<-ϦzSV-�U�R�{M=H�,�0�+�/̨̩��̪��$�(�#�'� �� k Requête brute (extrait) +Ž')V��Y��y�ú?odj�^\sՕ >��e�Mq�#<-ϦzSV-�U�R�{M=H�,�0�+�/̨̩��̪��$�(�#�'� �� kg93��=<5/~� � http/1.11 64 Meta JSON brut {"protocol_emulated":true,"emulator_response":"00000010000000000000000000000000","emulator_response_len":16,"bytes_in":1560,"payload_entropy":7.702644610219704,"port_category":"registered","org":"Google LLC","service":"i2p","app_proto":"i2p","asn":396982,"country":"BE","dst_port":4444,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":40,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.2,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":30,"novelty":15},"risk_score":24,"tag_count":4,"anomaly_count":0,"campaign_key":"304f3ffd9d07028a5a9bd31bde61a37c016e139a","event_fingerprint":"6184803cbed361f58b909ed8bd1c95271e8c683c","classification_reason":"Type \u00ab i2p_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":40,"protocol":30,"novelty":15,"risk_score":24,"correlation_boost":8},"named_classification_skipped":false,"service_name":"i2p","risk_confidence_factor":0,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Google LLC","is_datacenter":true,"is_tor_hint":false},"fingerprint":{"payload_hash":"2db03cc4998c3ad28dea698c2fe50a5b","path_pattern_hash":"63fac6162f0d2de1da7489cc7f99c131"},"target_context":{"dst_port":4444,"service":"i2p","service_name":"i2p","risk_score":24},"payload_pr…
26/10/2026 12:57:37 UTC	TCP	1207 · HTTP	http	Sonde port 1207/TCP port 1207 tcp · via HTTP:1207 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1207 Chemin / cible / Preuve honeypot — Sonde port 1207/TCP Connexion détectée sur le port 1207 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 1207/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1207 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1207 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"f3dc7b1e8742ef425fa4df89199a472507074d2f","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.116248125028156,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":1207,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":6,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"2d31554abc6bd0b12c89f46df9fcce2f4be16fd5","event_fingerprint":"b799b1757e75ae81515c9691d9272c3ceacb02d0","classification_reason":"Type \u00ab port_1207_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Goog…
26/10/2026 12:49:05 UTC	TCP	3689 · HTTP	http	Sonde port 3689/TCP port 3689 tcp · via HTTP:3689 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3689 Chemin / cible / Preuve honeypot — Sonde port 3689/TCP Connexion détectée sur le port 3689 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 3689/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3689 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3689 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"ee0f2b5236d56b9c20b5bb2ce8a8c21a75035a2e","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.132620450545713,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":3689,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":1.4,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"7529d7a71f5399b791d247c2b9f3c70ba40cbd40","event_fingerprint":"d41e492003b9429310315e2b202258188790bb75","classification_reason":"Type \u00ab port_3689_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
26/10/2026 12:38:27 UTC	TCP	6081 · HTTP	http	Sonde port 6081/TCP port 6081 tcp · via HTTP:6081 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6081 Chemin / cible / Preuve honeypot — Sonde port 6081/TCP Connexion détectée sur le port 6081 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 6081/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6081 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6081 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"e24da4a7319bd4bf5b41153d1e16b326ed1eb366","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.124776292821557,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":6081,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":2.2,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"1ecaecc7d3d3d35ad850dc027f9c824fa865e827","event_fingerprint":"220d5d9ddfac38b9b996c698fd95ec619bb1eb8b","classification_reason":"Type \u00ab port_6081_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
26/10/2026 12:35:20 UTC	TCP	9198 · HTTP	http	Sonde port 9198/TCP port 9198 tcp · via HTTP:9198 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9198 Chemin / cible / Preuve honeypot — Sonde port 9198/TCP Connexion détectée sur le port 9198 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 9198/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9198 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9198 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"e313d7c9c6a4a067dedc2189f8b6ea71a0ac796d","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.138474922958543,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":9198,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":4.9,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"3e57371f8837a7c730acf9c082caf5369eff92ea","event_fingerprint":"3d592513e99c154c119bc84b46cc38577ed60995","classification_reason":"Type \u00ab port_9198_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
26/10/2026 12:26:06 UTC	TCP	32764 · HTTP	http	Sonde backdoor routeur (32764/TCP) port 32764 tcp · via HTTP:32764 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 32764 Chemin / cible / Preuve honeypot — Sonde backdoor routeur (32764/TCP) Connexion détectée sur le port 32764 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde backdoor routeur (32764/TCP) » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:32764 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connect Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:32764 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"4796727b92dc6815ce1dae9d7e2323dcca41ff8e","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":147,"payload_entropy":5.120781784872791,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":32764,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":5.9,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"4477e31def16c0802db090ffd6d77837babd2b12","event_fingerprint":"5ca8647725ab9efe97990c400450a04be149479a","classification_reason":"Type \u00ab port_32764_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"…
26/10/2026 11:55:29 UTC	TCP	2154 · HTTP	http	Sonde port 2154/TCP port 2154 tcp · via HTTP:2154 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2154 Chemin / cible / Preuve honeypot — Sonde port 2154/TCP Connexion détectée sur le port 2154 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 2154/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2154 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2154 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"e42ba49705c0a70b16cc9285ee58bbf514d9c25d","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.1025494948911705,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":2154,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":3.8,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"c55d2846c42a936fe47634f343f1b131428202a5","event_fingerprint":"fb563a25d16e98d6f74a04a65a74431537f2b041","classification_reason":"Type \u00ab port_2154_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"G…
26/10/2026 11:51:53 UTC	TCP	12169 · HTTP	http	Sonde port 12169/TCP port 12169 tcp · via HTTP:12169 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12169 Chemin / cible / Preuve honeypot — Sonde port 12169/TCP Connexion détectée sur le port 12169 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 12169/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12169 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connect Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:12169 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"afcf4efe62686831be3a33d25762aa2ea8a739e8","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":147,"payload_entropy":5.118126277896171,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":12169,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":4.1,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"eaf56137ab814f757694c7e36f336172b719a7b6","event_fingerprint":"58ca0771d2895121988393aa413381ba1f301617","classification_reason":"Type \u00ab port_12169_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"…
26/10/2026 11:49:22 UTC	TCP	311 · HTTP	http	Sonde port 311/TCP port 311 tcp · via HTTP:311 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 311 Chemin / cible / Preuve honeypot — Sonde port 311/TCP Connexion détectée sur le port 311 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 311/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:311 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connectio Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:311 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"06bcadc846b21ed383a2c38e245acadf517e9967","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":145,"payload_entropy":5.080931160243843,"port_category":"well_known","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":311,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":1.6,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"5d3576927224ca672ec5401e64ab3b4690115734","event_fingerprint":"c5386f708c68e0aed9d519a655f544135f7984e1","classification_reason":"Type \u00ab port_311_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Goog…
26/10/2026 11:46:16 UTC	TCP	8195 · HTTP	http	Sonde port 8195/TCP port 8195 tcp · via HTTP:8195 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8195 Chemin / cible / Preuve honeypot — Sonde port 8195/TCP Connexion détectée sur le port 8195 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 8195/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8195 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8195 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"7543db201270d859ee7ef48cc68f4fde46e3c910","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.138474922958543,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8195,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":3.2,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"b226ee484447b75ba79d84ba0e2e85d261d79b5e","event_fingerprint":"a7fbf111c239ac208d2ccd01980a2fea3fc65184","classification_reason":"Type \u00ab port_8195_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
26/10/2026 11:45:59 UTC	TCP	6482 · HTTP	http	Sonde port 6482/TCP port 6482 tcp · via HTTP:6482 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6482 Chemin / cible / Preuve honeypot — Sonde port 6482/TCP Connexion détectée sur le port 6482 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 6482/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6482 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6482 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"4beb9928279e976a7b207dea37fb3662e8ace2ed","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.121418587371742,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":6482,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":1.9,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"058c8528a4ff212697ea5461d93ea39392701ce4","event_fingerprint":"3928f8c0ac78a8a7ac230d2d3ea99314e484fc3a","classification_reason":"Type \u00ab port_6482_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
26/10/2026 11:40:23 UTC	TCP	591 · HTTP	http	Sonde FileMaker (591/TCP) port 591 tcp · via HTTP:591 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 591 Chemin / cible / Preuve honeypot — Sonde FileMaker (591/TCP) Connexion détectée sur le port 591 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde FileMaker (591/TCP) » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:591 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connectio Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:591 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"d63885d1f1b06da9a39b56d573e583c2216d3a11","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":145,"payload_entropy":5.114412215225038,"port_category":"well_known","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":591,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":1.7,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"698147b8d41b365e3564a90718ce59fe8b085d01","event_fingerprint":"1e7d365cc1f5089a65fcad7aa72675aa08f14799","classification_reason":"Type \u00ab port_591_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Goog…
26/10/2026 11:40:13 UTC	TCP	8100 · HTTP	http	Sonde port 8100/TCP port 8100 tcp · via HTTP:8100 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8100 Chemin / cible / Preuve honeypot — Sonde port 8100/TCP Connexion détectée sur le port 8100 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 8100/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8100 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8100 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"6eae026ce138d6d2c762facfcf5ef15124599371","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.119605830477972,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8100,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":2.8,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"275412be9af05e22cc272bfea8a53beddef2fbd4","event_fingerprint":"7a28466e5f8dfbb9565954466fd6e0ef2b9ef823","classification_reason":"Type \u00ab port_8100_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
26/10/2026 11:38:22 UTC	TCP	9222 · HTTP	http	Sonde DevTools (9222/TCP) port 9222 tcp · via HTTP:9222 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9222 Chemin / cible / Preuve honeypot — Sonde DevTools (9222/TCP) Connexion détectée sur le port 9222 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde DevTools (9222/TCP) » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9222 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9222 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"6939de574b59c0d5a3322771de80c0f7f3eb9b59","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.097379032547585,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":9222,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":3.8,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"7daf065fc712e821d1e0a62139ad22d9d3201b60","event_fingerprint":"64f07b80f953b5153b36eb5228ca2be70b8dbb20","classification_reason":"Type \u00ab port_9222_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
26/10/2026 11:37:45 UTC	TCP	5245 · HTTP	http	Sonde port 5245/TCP port 5245 tcp · via HTTP:5245 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5245 Chemin / cible / Preuve honeypot — Sonde port 5245/TCP Connexion détectée sur le port 5245 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 5245/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5245 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5245 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"dc28fc4fcf7cbe002d56c5bd9ea44345a7eb3411","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.1025494948911705,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":5245,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":2.4,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"817146a1c8bcd373bb5dc1d84f32c317efbdb033","event_fingerprint":"a300a3bd63fb4644e532ebb4b1c042beac2e77f6","classification_reason":"Type \u00ab port_5245_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"G…
25/10/2026 13:54:40 UTC	TCP	8902 · HTTP	http	Sonde port 8902/TCP port 8902 tcp · via HTTP:8902 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8902 Chemin / cible / Preuve honeypot — Sonde port 8902/TCP Connexion détectée sur le port 8902 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 8902/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8902 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8902 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"bdb557ed38233898da67b90db52d2814a34831e3","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.135117217508728,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8902,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":2.2,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"23ee95326c7c990c9614dcb2a9f44503e6f31eeb","event_fingerprint":"591c5c4f5d7d0440c24c489692b040d885c6dbcb","classification_reason":"Type \u00ab port_8902_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
25/10/2026 13:49:33 UTC	TCP	2210 · HTTP	http	Sonde port 2210/TCP port 2210 tcp · via HTTP:2210 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2210 Chemin / cible / Preuve honeypot — Sonde port 2210/TCP Connexion détectée sur le port 2210 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 2210/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2210 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:2210 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"421927ec96febb7e8b283b72721c1ee33ba44e21","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.091524560134753,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":2210,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":2.8,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"3b5960f0d758959cd8c540c717f236f7e30f9d81","event_fingerprint":"d9c257127c2f7c72a52342fbed5859fcc42f2f2a","classification_reason":"Type \u00ab port_2210_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
25/10/2026 13:47:09 UTC	TCP	8475 · HTTP	http	Sonde port 8475/TCP port 8475 tcp · via HTTP:8475 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8475 Chemin / cible / Preuve honeypot — Sonde port 8475/TCP Connexion détectée sur le port 8475 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 8475/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8475 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8475 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"22403bd2f94a9a3bc13e5f2031f807c747f8b621","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.143645385302128,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8475,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":3.3,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"93d034dde14000635947ec8d4088fd8ab4a40bdc","event_fingerprint":"4cef6de5102e31ca4291630890479dac015f35a3","classification_reason":"Type \u00ab port_8475_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Go…
25/10/2026 13:46:55 UTC	TCP	3443 · HTTP	http	Sonde port 3443/TCP port 3443 tcp · via HTTP:3443 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3443 Chemin / cible / Preuve honeypot — Sonde port 3443/TCP Connexion détectée sur le port 3443 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde port 3443/TCP » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3443 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3443 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"56dfa025d791be489b2eaa3dd21a0dbd36a1ee00","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.0870381078604145,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":3443,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":1.7,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"e6ace64cd8c7bbafe7293828c1bcc81a36b726fd","event_fingerprint":"8f54fa779466900c1486be11661a3b87e84eae57","classification_reason":"Type \u00ab port_3443_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"G…
25/10/2026 13:46:07 UTC	TCP	8001 · HTTP	http	Sonde HTTP alternatif (8001/TCP) port 8001 tcp · via HTTP:8001 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8001 Chemin / cible / Preuve honeypot — Sonde HTTP alternatif (8001/TCP) Connexion détectée sur le port 8001 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde HTTP alternatif (8001/TCP) » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connecti Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"29d114ae8a3567c5f1863f5bd79c5d398a432fe8","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":146,"payload_entropy":5.119605830477972,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8001,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":2.2,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":38,"tag_count":5,"anomaly_count":1,"campaign_key":"0f11ec99f0865a8dc3ffa815519261139a223d3d","event_fingerprint":"678d926e98c4c6c06c358f11fdcb1b1513183571","classification_reason":"Type \u00ab port_8001_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":43,"novel…
25/10/2026 13:40:12 UTC	TCP	853 · HTTP	http	Sonde DNS sur TLS (853/TCP) port 853 tcp · via HTTP:853 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole GET / UA python-requests/2.34.2 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950734:sap-sapcontrol-path scanner-ua anomaly:scanner-ua http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 853 Chemin / cible / Preuve honeypot — Sonde DNS sur TLS (853/TCP) Connexion détectée sur le port 853 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Type « Sonde DNS sur TLS (853/TCP) » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET / HTTP/1.1` User-Agent python-requests/2.34.2 Règles WAF sap-sapcontrol-path scanner-ua Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:853 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connectio Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:853 User-Agent: python-requests/2.34.2 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"39629e9324a6a8ca42f0eb616186476a68e5066b","http_host_hash":"0d896041bc9a9b9c864ca122ae274204c0e0c55e","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":145,"payload_entropy":5.1085173671403945,"port_category":"well_known","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":853,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":40,"risk_protocol":35,"risk_novelty":20,"risk_boost":0,"risk_granularity":4,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20},"risk_score":38,"tag_count":4,"anomaly_count":1,"campaign_key":"6792c60f5017eaaadd3e087800a5d555575c0f28","event_fingerprint":"df79d7ad5b658e88630e831cba00914e9384fa95","classification_reason":"Type \u00ab port_853_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":40,"protocol":35,"novelty":20,"risk_score":38},"named_classification_skipped":true,"named_candidate":"web_scanner","service_name":"http","risk_confidence_factor":55,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"BE","asn":396982,"org":"Googl…

34.76.160.254

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence