Fiche IP

Belgique

34.78.147.33

Activité suspecte — risque 67/100 (Élevé) — MITRE T1046 — confiance 100 % — via HTTP — multi-protocole (1627 protocoles · 5 min)

Campagne multi-ports détectée sur une fenêtre courte

FAI Google LLC Première vue 13/11/2026 00:00 UTC Dernière vue 14/11/2026 16:28 UTC Risque Élevé

Période 2026-10-15 → 2026-11-14

Élevé 84/100

24h 7j 30j 90j

Synthèse

Score de risque max. 84/100 Élevé · Maximum de risk_score (événements honeypot)

Première observation 13/11/2026 00:00 UTC

Dernière observation 14/11/2026 16:28 UTC

Événements (période) 10,049

Décision conseillée Investiguer Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal T1046 10051 occurrences

Pourquoi listée

Type « Scan de ports » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 100 · Bonus corrélation +23 · 5 tag(s) WAF

Décision

Restreindre

Risque élevé. Limitez le débit vers les services sensibles et réévaluez sous 24 h avant un blocage durable.

84/100 Confiance 100 % 10,049 événements T1046

À faire

Limiter le débit ou isoler 34.78.147.33 des services d’administration.
Surveiller les ports des dernières 24 h.
Passer en blocage si le régime devient une rafale ou si le score atteint 85.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 34.78.147.33
Décision : Restreindre
Score max : 84/100 (Élevé)
Confiance : 100 %
Période : 2026-10-15 → 2026-11-14 · 10049 événements
Motif : Type « Scan de ports » (signaux protocolaires) · confiance 100%
MITRE : T1046
FAI : Google LLC · Belgique

Comparaison ASN / FAI

ASN 396982 · 34.78.144.0/20 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 10,049 événements sur la période pour cette IP.

35.206.141.5 Tentative d'exploit 14/11/2026 14:42 UTC
216.180.246.16 SSRF 14/11/2026 14:40 UTC
35.210.218.170 Tentative d'exploit 14/11/2026 14:27 UTC
216.180.246.110 SSRF 14/11/2026 14:05 UTC
216.180.246.46 SSRF 14/11/2026 14:01 UTC
216.180.246.204 SSRF 14/11/2026 13:58 UTC
216.180.246.85 Sonde Jenkins 14/11/2026 13:53 UTC
216.180.246.78 SSRF 14/11/2026 13:49 UTC

Événements (filtres)

10,049

Première observation

13/11/2026 00:00 UTC

Dernière observation

14/11/2026 16:28 UTC

Dernière activité (filtres)

14/11/2026 16:28 UTC

Événements 7j

10,049

Ports distincts (7j)

1655

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 2,571 SAP Diag TCP 270 SMB TCP 60 MONGODB TCP 35 IRC ALT TCP 34 TOR OR TCP 34 XMPP SERVER TCP 33 FLINK TCP 32 KAFKA JMX TCP 32 KAFKA CONTROLLER TCP 32 IRC TCP 32 SAP ICM TCP 32 KAFKA TCP 32 GAME UNREAL TCP 32 UPNP SSL TCP 31 NETBUS TCP 31 I2P TCP 31 STRATUM TCP 31 OPENVPN TCP 31 SQUID ALT TCP 31

HTTP

2,571

SAP Diag

270

SMB

MONGODB

IRC ALT

TOR OR

Géolocalisation

Origine réseau déclarée

Belgique unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Google LLC 0 Port 10000 Scan de ports

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · via HTTP:8858 · (reconnaissance) · → /evox/about

Détails protocole

Méthode: GET
Chemin: /evox/about
User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)

Aperçu payload

GET /evox/about HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.

Port / service

8858 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 100 % — 5 tag(s) WAF

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min)

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S

Confiance

100% Corrélation +23

Famille de menace

scanner

MITRE ATT&CK — tactiques observées

Reconnaissance

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

10,049 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

10049 événement(s) — page 1/402

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
14/11/2026 16:28:36 UTC	TCP	3559 · HTTP	http	Scan de ports port scan syn · via HTTP:3559 · (reconnaissance) · → /sdk	Élevée	Élevé · 83
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Accès Protocole POST /sdk UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 48 Recommandation Investiguer Tags 950079:sqli-19 950326:rce-0 950327:rce-0 950406:ssrf-3 Cible HTTP POST /sdk TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3559 Chemin / cible /sdk Service HTTP Pourquoi cette classification : Motif SSRF · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Élevé · 83 Confiance : Confiance 100 % — 8 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Accès initial Ligne de requête `POST /sdk HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF sqli-19 rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) POST /sdk HTTP/1.1 Content-Length: 441 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.h Requête brute (extrait) POST /sdk HTTP/1.1 Content-Length: 441 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:3559 Connection: close <soap:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http:// Meta JSON brut {"http_header_count":4,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"84bc789bdd99fc1db44cdfea0dc48d164683797f","http_target_hash":"5e2a035222ca1432dd7a4c0062da7711ee276c61","http_referer_hash":null,"http_method":"POST","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":619,"payload_entropy":5.291737321476529,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":3559,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":15,"risk_granularity":7,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":83,"tag_count":13,"anomaly_count":1,"campaign_key":"6666f1e027fa6e6e71b245f461dfb4993ec86117","event_fingerprint":"4c3a6adcc559b761a32bc92379d696055ba3729c","classification_reason":"Motif SSRF \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":83,"correlation_boost":23},"named_classification_skipped":false,"service_name":"http","risk_confidence…
14/11/2026 16:28:36 UTC	TCP	33354 · HTTP	http	Scan de ports port scan syn · via HTTP:33354 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_no_ua net_flood Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 33354 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.0 Meta JSON brut {"http_header_count":0,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":null,"http_host_hash":null,"http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":18,"payload_entropy":3.461320140211008,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":33354,"risk_waf":20,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":0,"risk_boost":0,"risk_granularity":5.7,"risk_breakdown":{"waf":20,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":0},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"bdda7a3eb2eecd49ecf05689a5b8f37df4c512f4","event_fingerprint":"72b0243d1fbda4215a846fed5ddd3ac2629cfab5","classification_reason":"Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":20,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":100,"city":null,"is_datacenter":true,"is_tor_hint":fal…
14/11/2026 16:28:36 UTC	TCP	8858 · HTTP	http	Scan de ports port scan syn · via HTTP:8858 · (reconnaissance) · → /sdk	Élevée	Élevé · 83
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Accès Protocole POST /sdk UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 48 Recommandation Investiguer Tags 950079:sqli-19 950326:rce-0 950327:rce-0 950406:ssrf-3 Cible HTTP POST /sdk TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8858 Chemin / cible /sdk Service HTTP Pourquoi cette classification : Motif SSRF · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Élevé · 83 Confiance : Confiance 100 % — 8 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Accès initial Ligne de requête `POST /sdk HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF sqli-19 rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) POST /sdk HTTP/1.1 Content-Length: 441 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.h Requête brute (extrait) POST /sdk HTTP/1.1 Content-Length: 441 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:8858 Connection: close <soap:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http:// Meta JSON brut {"http_header_count":4,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"5284da8f92c848ee606b0aad12a409cb805ecb6e","http_target_hash":"5e2a035222ca1432dd7a4c0062da7711ee276c61","http_referer_hash":null,"http_method":"POST","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":619,"payload_entropy":5.296187866714273,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8858,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":15,"risk_granularity":6.7,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":83,"tag_count":13,"anomaly_count":1,"campaign_key":"8d3c75dd974315e58bf3cad9205975f9dc44757a","event_fingerprint":"cd01619bac39bd42693d6e0665ca6443eeeaa620","classification_reason":"Motif SSRF \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":83,"correlation_boost":23},"named_classification_skipped":false,"service_name":"http","risk_confiden…
14/11/2026 16:28:36 UTC	TCP	3559 · HTTP	http	Scan de ports port scan syn · via HTTP:3559 · (reconnaissance) · → /evox/about	Élevée	Élevé · 68
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /evox/about UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 28 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /evox/about TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3559 Chemin / cible /evox/about Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Élevé · 68 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /evox/about HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /evox/about HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62. Requête brute (extrait) GET /evox/about HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:3559 Connection: close Meta JSON brut {"http_header_count":3,"http_query_params":0,"http_path_depth":2,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"84bc789bdd99fc1db44cdfea0dc48d164683797f","http_target_hash":"9e931bb53b054c2fff95daa013fecdd4ca2a01a2","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":163,"payload_entropy":5.146120276524799,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":3559,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":6.8,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":68,"tag_count":8,"anomaly_count":1,"campaign_key":"a90dbd6dbe7fb64043f8e03bd4d88076c8dd6c1c","event_fingerprint":"661e3a3ff5310158cc1a69b4df5ff8823cb07848","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":68,"correlation_boost":23},"named_classification_skipped"…
14/11/2026 16:28:36 UTC	TCP	1247 · HTTP	http	Scan de ports port scan syn · via HTTP:1247 · (reconnaissance) · → /sdk	Élevée	Élevé · 80
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Accès Protocole POST /sdk UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 48 Recommandation Investiguer Tags 950079:sqli-19 950326:rce-0 950327:rce-0 950406:ssrf-3 Cible HTTP POST /sdk TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 1247 Chemin / cible /sdk Service HTTP Pourquoi cette classification : Motif SSRF · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Élevé · 80 Confiance : Confiance 100 % — 8 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Accès initial Ligne de requête `POST /sdk HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF sqli-19 rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) POST /sdk HTTP/1.1 Content-Length: 441 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.h Requête brute (extrait) POST /sdk HTTP/1.1 Content-Length: 441 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:1247 Connection: close <soap:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http:// Meta JSON brut {"http_header_count":4,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"1eb50cb5e30feff3bfdce753e57ef520d8f2b0c9","http_target_hash":"5e2a035222ca1432dd7a4c0062da7711ee276c61","http_referer_hash":null,"http_method":"POST","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":619,"payload_entropy":5.291804920797962,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":1247,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":15,"risk_granularity":4.1,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":80,"tag_count":13,"anomaly_count":1,"campaign_key":"4c0c0c85abb5172152083fce3b531fb18a034711","event_fingerprint":"353b3779901b6d4951180366217bbb3fcef7a1cd","classification_reason":"Motif SSRF \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":80,"correlation_boost":23},"named_classification_skipped":false,"service_name":"http","risk_confiden…
14/11/2026 16:28:36 UTC	TCP	1141 · HTTP	http	Scan de ports port scan syn · via HTTP:1141 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_no_ua net_flood Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1141 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.0 Meta JSON brut {"http_header_count":0,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":null,"http_host_hash":null,"http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":18,"payload_entropy":3.461320140211008,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":1141,"risk_waf":20,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":0,"risk_boost":0,"risk_granularity":5,"risk_breakdown":{"waf":20,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":0},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"4f2aabb1124e36a4c368af2906efc35068cba2d8","event_fingerprint":"723c53d96d52b70c23fd21e7ad1e407b3452fce8","classification_reason":"Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":20,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":100,"city":null,"is_datacenter":true,"is_tor_hint":false,…
14/11/2026 16:28:36 UTC	TCP	1141 · HTTP	http	Scan de ports port scan syn · via HTTP:1141 · (reconnaissance) · → /nmaplowercheck1794673716	Élevée	Élevé · 66
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /nmaplowercheck1794673716 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /nmaplowercheck1794673716 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1141 Chemin / cible /nmaplowercheck1794673716 Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Élevé · 66 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /nmaplowercheck1794673716 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /nmaplowercheck1794673716 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.ht Requête brute (extrait) GET /nmaplowercheck1794673716 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:1141 Connection: close Meta JSON brut {"http_header_count":3,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"f73f4eccd41eafc27d44a99555df0eec244442b0","http_target_hash":"6c8a87111d7a0ee3df0fb4c189803dc275c8a166","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":177,"payload_entropy":5.197220724685292,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":1141,"risk_waf":96,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":6.4,"risk_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":66,"tag_count":7,"anomaly_count":1,"campaign_key":"1711f5a5a05e2fa07ff4ba5ced5e81d7fdcb1fca","event_fingerprint":"e19cae95f9bdd96ae2558cc0f2fc427a16125cb5","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":66,"correlation_boost":23},"named_classification_skipped":fa…
14/11/2026 16:28:36 UTC	TCP	1107 · HTTP	http	Scan de ports port scan syn · via HTTP:1107 · (reconnaissance) · → /sdk	Élevée	Élevé · 82
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Accès Protocole POST /sdk UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 48 Recommandation Investiguer Tags 950079:sqli-19 950326:rce-0 950327:rce-0 950406:ssrf-3 Cible HTTP POST /sdk TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 1107 Chemin / cible /sdk Service HTTP Pourquoi cette classification : Motif SSRF · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Élevé · 82 Confiance : Confiance 100 % — 8 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Accès initial Ligne de requête `POST /sdk HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF sqli-19 rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) POST /sdk HTTP/1.1 Content-Length: 441 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.h Requête brute (extrait) POST /sdk HTTP/1.1 Content-Length: 441 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:1107 Connection: close <soap:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http:// Meta JSON brut {"http_header_count":4,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"5bf657bc5d9107d4a61eae9c0dc8804716062abb","http_target_hash":"5e2a035222ca1432dd7a4c0062da7711ee276c61","http_referer_hash":null,"http_method":"POST","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":619,"payload_entropy":5.2853995879756885,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":1107,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":15,"risk_granularity":6.5,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":82,"tag_count":13,"anomaly_count":1,"campaign_key":"0d2bdd79cd80e3ad740c7c61070191ffe1468351","event_fingerprint":"c2ab25f601d897091efeb43bc593bc676980eb20","classification_reason":"Motif SSRF \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":82,"correlation_boost":23},"named_classification_skipped":false,"service_name":"http","risk_confide…
14/11/2026 16:28:36 UTC	TCP	3082 · HTTP	http	Scan de ports port scan syn · via HTTP:3082 · (reconnaissance) · → /evox/about	Élevée	Élevé · 66
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /evox/about UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 28 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /evox/about TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3082 Chemin / cible /evox/about Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Élevé · 66 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /evox/about HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /evox/about HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62. Requête brute (extrait) GET /evox/about HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:3082 Connection: close Meta JSON brut {"http_header_count":3,"http_query_params":0,"http_path_depth":2,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"7744872f368c1cdc409a0906251d58557a996d1b","http_target_hash":"9e931bb53b054c2fff95daa013fecdd4ca2a01a2","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":163,"payload_entropy":5.1537590035053915,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":3082,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":4.9,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":66,"tag_count":8,"anomaly_count":1,"campaign_key":"a0b7c759ba2ce5bfa5de3fa70c0078675c1c8bc1","event_fingerprint":"30518ee92ed424cb76863a60a13f6d3831b8e01a","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":66,"correlation_boost":23},"named_classification_skipped…
14/11/2026 16:28:36 UTC	TCP	1247 · HTTP	http	Scan de ports port scan syn · via HTTP:1247 · (reconnaissance) · → /nmaplowercheck1794673716	Élevée	Moyen · 63
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /nmaplowercheck1794673716 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /nmaplowercheck1794673716 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1247 Chemin / cible /nmaplowercheck1794673716 Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 63 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /nmaplowercheck1794673716 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /nmaplowercheck1794673716 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.ht Requête brute (extrait) GET /nmaplowercheck1794673716 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:1247 Connection: close Meta JSON brut {"http_header_count":3,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"1eb50cb5e30feff3bfdce753e57ef520d8f2b0c9","http_target_hash":"6c8a87111d7a0ee3df0fb4c189803dc275c8a166","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":177,"payload_entropy":5.213021467522183,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":1247,"risk_waf":96,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":3.6,"risk_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":63,"tag_count":7,"anomaly_count":1,"campaign_key":"e62488ac2792b664a894901cf2e0fb2d2aebb01f","event_fingerprint":"55a890282c82092d8743176d239826484a5b021a","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":63,"correlation_boost":23},"named_classification_skipped":fa…
14/11/2026 16:28:36 UTC	TCP	8423 · HTTP	http	Scan de ports port scan syn · via HTTP:8423 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_no_ua net_flood Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8423 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.0 Meta JSON brut {"http_header_count":0,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":null,"http_host_hash":null,"http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":18,"payload_entropy":3.461320140211008,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8423,"risk_waf":20,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.6,"risk_breakdown":{"waf":20,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":0},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"c643da4a048b6720cb7d56ff0730413c9ea21305","event_fingerprint":"999124cfaecbc002488057c50a528b069da0ee75","classification_reason":"Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":20,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":100,"city":null,"is_datacenter":true,"is_tor_hint":fals…
14/11/2026 16:28:36 UTC	TCP	8182 · HTTP	http	Scan de ports port scan syn · via HTTP:8182 · (reconnaissance) · → /sdk	Élevée	Élevé · 84
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Accès Protocole POST /sdk UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 48 Recommandation Investiguer Tags 950079:sqli-19 950326:rce-0 950327:rce-0 950406:ssrf-3 Cible HTTP POST /sdk TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8182 Chemin / cible /sdk Service HTTP Pourquoi cette classification : Motif SSRF · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Élevé · 84 Confiance : Confiance 100 % — 8 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Accès initial Ligne de requête `POST /sdk HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF sqli-19 rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) POST /sdk HTTP/1.1 Content-Length: 441 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.h Requête brute (extrait) POST /sdk HTTP/1.1 Content-Length: 441 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:8182 Connection: close <soap:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http:// Meta JSON brut {"http_header_count":4,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"bb43dd67f50ce519b54de61cc2221f483ecf7725","http_target_hash":"5e2a035222ca1432dd7a4c0062da7711ee276c61","http_referer_hash":null,"http_method":"POST","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":619,"payload_entropy":5.2930244482651085,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8182,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":15,"risk_granularity":7.6,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":84,"tag_count":13,"anomaly_count":1,"campaign_key":"684d5711139102a4f91c2c79a392c5356a26f7d1","event_fingerprint":"3e76131dfddbb946a5a3b3f14845f306278c6da8","classification_reason":"Motif SSRF \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":84,"correlation_boost":23},"named_classification_skipped":false,"service_name":"http","risk_confide…
14/11/2026 16:28:36 UTC	TCP	8056 · HTTP	http	Scan de ports port scan syn · via HTTP:8056 · (reconnaissance) · → /evox/about	Élevée	Élevé · 68
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /evox/about UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 28 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /evox/about TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8056 Chemin / cible /evox/about Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Élevé · 68 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /evox/about HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /evox/about HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62. Requête brute (extrait) GET /evox/about HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:8056 Connection: close Meta JSON brut {"http_header_count":3,"http_query_params":0,"http_path_depth":2,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"294ac2acb4b21ea321d70ac0b666249ea84d8e2b","http_target_hash":"9e931bb53b054c2fff95daa013fecdd4ca2a01a2","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":163,"payload_entropy":5.156766518816268,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8056,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":7.1,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":68,"tag_count":8,"anomaly_count":1,"campaign_key":"a5c271c8c63421d24d8ebdbdd45513d13f941047","event_fingerprint":"1a1ec245c5c39817ef6e33675a270ad35dee860e","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":68,"correlation_boost":23},"named_classification_skipped"…
14/11/2026 16:28:36 UTC	TCP	4224 · HTTP	http	Scan de ports port scan syn · via HTTP:4224 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_no_ua net_flood Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4224 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.0 Meta JSON brut {"http_header_count":0,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":null,"http_host_hash":null,"http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":18,"payload_entropy":3.461320140211008,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":4224,"risk_waf":20,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":20,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":0},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"71d9c5320017c5ec418eaa68df127695cca10bb1","event_fingerprint":"8df7f2fa8f39203d42020f8c7763dd5b7f129724","classification_reason":"Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":20,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":100,"city":null,"is_datacenter":true,"is_tor_hint":fals…
14/11/2026 16:28:36 UTC	TCP	8858 · HTTP	http	Scan de ports port scan syn · via HTTP:8858 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_no_ua net_flood Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8858 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.0 Meta JSON brut {"http_header_count":0,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":null,"http_host_hash":null,"http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":18,"payload_entropy":3.461320140211008,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8858,"risk_waf":20,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.7,"risk_breakdown":{"waf":20,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":0},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"5cbf9129b589777dfd83ff12a39fee4a408c04b6","event_fingerprint":"960e6d03276201f5ad27b25fee1b92d7918d7b68","classification_reason":"Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":20,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":100,"city":null,"is_datacenter":true,"is_tor_hint":fals…
14/11/2026 16:28:36 UTC	TCP	8858 · HTTP	http	Scan de ports port scan syn · via HTTP:8858 · (reconnaissance) · → /nmaplowercheck1794673716	Élevée	Élevé · 66
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /nmaplowercheck1794673716 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /nmaplowercheck1794673716 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8858 Chemin / cible /nmaplowercheck1794673716 Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Élevé · 66 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /nmaplowercheck1794673716 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /nmaplowercheck1794673716 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.ht Requête brute (extrait) GET /nmaplowercheck1794673716 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:8858 Connection: close Meta JSON brut {"http_header_count":3,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"5284da8f92c848ee606b0aad12a409cb805ecb6e","http_target_hash":"6c8a87111d7a0ee3df0fb4c189803dc275c8a166","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":177,"payload_entropy":5.231919648132051,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8858,"risk_waf":96,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":6.1,"risk_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":66,"tag_count":7,"anomaly_count":1,"campaign_key":"ea4be49d21e8409273291427e81944714a5fe0c6","event_fingerprint":"ece270269e985fd9bad464b596b02aecb787fa13","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":66,"correlation_boost":23},"named_classification_skipped":fa…
14/11/2026 16:28:36 UTC	TCP	3074 · HTTP	http	Scan de ports port scan syn · via HTTP:3074 · (reconnaissance) · → /HNAP1	Élevée	Moyen · 63
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /HNAP1 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /HNAP1 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3074 Chemin / cible /HNAP1 Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 63 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /HNAP1 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /HNAP1 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50. Requête brute (extrait) GET /HNAP1 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:3074 Connection: close Meta JSON brut {"http_header_count":3,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"f86ccaf594926a578aaab79b4a42f42ca71be0a0","http_target_hash":"92c22322858be108c9b5ebcfd6f2c3cb5ceee211","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":158,"payload_entropy":5.1634361931150154,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":3074,"risk_waf":96,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":3.6,"risk_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":63,"tag_count":8,"anomaly_count":1,"campaign_key":"e7399197cfa861e224419e320fa9ca9194fc927b","event_fingerprint":"07416813a038d78f9c7f7a53857278b15542f40d","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":63,"correlation_boost":23},"named_classification_skipped":f…
14/11/2026 16:28:36 UTC	TCP	8081 · HTTP	http	Scan de ports port scan syn · via HTTP:8081 · (reconnaissance) · → /Nmap/folder/check1794673715	Élevée	Élevé · 67
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /Nmap/folder/check1794673715 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 28 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /Nmap/folder/check1794673715 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8081 Chemin / cible /Nmap/folder/check1794673715 Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Élevé · 67 Confiance : Confiance 100 % — 5 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /Nmap/folder/check1794673715 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /Nmap/folder/check1794673715 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse Requête brute (extrait) GET /Nmap/folder/check1794673715 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:8081 Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"http_header_count":3,"http_query_params":0,"http_path_depth":3,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24","http_target_hash":"e460f2d184af679479db98916f12498e5a2d27a5","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":180,"payload_entropy":5.254302861661475,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8081,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":6.2,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":67,"tag_count":8,"anomaly_count":1,"campaign_key":"ce24ba0fdd56e96c26241ed43f4b15cc911ef709","event_fingerprint":"9626e39ae4b1ec15619b9464e8e23c7e2cc329d9","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SI…
14/11/2026 16:28:36 UTC	TCP	4446 · HTTP	http	Scan de ports port scan syn · via HTTP:4446 · (reconnaissance) · → /HNAP1	Élevée	Élevé · 65
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /HNAP1 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /HNAP1 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4446 Chemin / cible /HNAP1 Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Élevé · 65 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /HNAP1 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /HNAP1 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50. Requête brute (extrait) GET /HNAP1 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:4446 Connection: close Meta JSON brut {"http_header_count":3,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"cd4de2ceb0a8b40041bbceb48b5e314613fd86b2","http_target_hash":"92c22322858be108c9b5ebcfd6f2c3cb5ceee211","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":158,"payload_entropy":5.1586584241139795,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":4446,"risk_waf":96,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":4.9,"risk_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":65,"tag_count":8,"anomaly_count":1,"campaign_key":"a29245661d78de297d64af9472f4df93bd088d5c","event_fingerprint":"3d3541221889402175f251fec91b78d97cff4dc4","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":65,"correlation_boost":23},"named_classification_skipped":f…
14/11/2026 16:28:36 UTC	TCP	3559 · HTTP	http	Scan de ports port scan syn · via HTTP:3559 · (reconnaissance) · → /nmaplowercheck1794673716	Élevée	Élevé · 66
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /nmaplowercheck1794673716 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /nmaplowercheck1794673716 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3559 Chemin / cible /nmaplowercheck1794673716 Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Élevé · 66 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /nmaplowercheck1794673716 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /nmaplowercheck1794673716 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.ht Requête brute (extrait) GET /nmaplowercheck1794673716 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:3559 Connection: close Meta JSON brut {"http_header_count":3,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"84bc789bdd99fc1db44cdfea0dc48d164683797f","http_target_hash":"6c8a87111d7a0ee3df0fb4c189803dc275c8a166","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":177,"payload_entropy":5.208756566380017,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":3559,"risk_waf":96,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":6.4,"risk_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":66,"tag_count":7,"anomaly_count":1,"campaign_key":"a3f577a50af8e5b9726698ea68ba8d71816d1000","event_fingerprint":"a077e0a19a190c9f8a47e81fb4aab3384b8eff6c","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":66,"correlation_boost":23},"named_classification_skipped":fa…
14/11/2026 16:28:36 UTC	TCP	2920 · HTTP	http	Scan de ports port scan syn · via HTTP:2920 · (reconnaissance) · → /HNAP1	Élevée	Moyen · 63
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /HNAP1 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /HNAP1 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2920 Chemin / cible /HNAP1 Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 63 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /HNAP1 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /HNAP1 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50. Requête brute (extrait) GET /HNAP1 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:2920 Connection: close Meta JSON brut {"http_header_count":3,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"44079f4a8ddd947bde96231325360d1e6dcb8064","http_target_hash":"92c22322858be108c9b5ebcfd6f2c3cb5ceee211","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":158,"payload_entropy":5.153880655112945,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":2920,"risk_waf":96,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":3.8,"risk_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":63,"tag_count":8,"anomaly_count":1,"campaign_key":"7940d171b568df730cb3cbf739e6c8d21ed4a063","event_fingerprint":"a8d531f87184c735b0573a92d3a7fac807344a6c","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":63,"correlation_boost":23},"named_classification_skipped":fa…
14/11/2026 16:28:36 UTC	TCP	3559 · HTTP	http	Scan de ports port scan syn · via HTTP:3559 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_no_ua net_flood Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3559 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.0 Meta JSON brut {"http_header_count":0,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":null,"http_host_hash":null,"http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":18,"payload_entropy":3.461320140211008,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":3559,"risk_waf":20,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":0,"risk_boost":0,"risk_granularity":5,"risk_breakdown":{"waf":20,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":0},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"745a3d272eed27549eee4c656ab7d38d921f5af2","event_fingerprint":"7bff594007ba3edf8cc3c35461c9ed330a38bb03","classification_reason":"Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":20,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":100,"city":null,"is_datacenter":true,"is_tor_hint":false,…
14/11/2026 16:28:36 UTC	TCP	9203 · HTTP	http	Scan de ports port scan syn · via HTTP:9203 · (reconnaissance) · → /evox/about	Élevée	Élevé · 68
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /evox/about UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 28 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /evox/about TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9203 Chemin / cible /evox/about Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Élevé · 68 Confiance : Confiance 100 % — 5 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /evox/about HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /evox/about HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62. Requête brute (extrait) GET /evox/about HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:9203 Connection: close Meta JSON brut {"http_header_count":3,"http_query_params":0,"http_path_depth":2,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"e92b718328952eaf8116e79ea0ca2c3046d5ed14","http_target_hash":"9e931bb53b054c2fff95daa013fecdd4ca2a01a2","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":163,"payload_entropy":5.1537590035053915,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":9203,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":7.1,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":68,"tag_count":8,"anomaly_count":1,"campaign_key":"49b00a99f1916fd64f9ff333b1623ac4baf295d0","event_fingerprint":"5919c19947caf9fa8651bc9f493566f20c2687cc","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":68,"correlation_boost":23},"named_classification_skipped…
14/11/2026 16:28:36 UTC	TCP	5102 · HTTP	http	Scan de ports port scan syn · via HTTP:5102 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_no_ua net_flood Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5102 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.0 Meta JSON brut {"http_header_count":0,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":null,"http_host_hash":null,"http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":18,"payload_entropy":3.461320140211008,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":5102,"risk_waf":20,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.9,"risk_breakdown":{"waf":20,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":0},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"8bdee61b7f109ff30c8d1fcfdd4608dcd98a2cd7","event_fingerprint":"dc6c93282f6f8eedf96a0728c4b716b8f4d128a2","classification_reason":"Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":20,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":100,"city":null,"is_datacenter":true,"is_tor_hint":fals…
14/11/2026 16:28:36 UTC	TCP	8056 · HTTP	http	Scan de ports port scan syn · via HTTP:8056 · (reconnaissance) · → /nmaplowercheck1794673716	Élevée	Élevé · 66
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /nmaplowercheck1794673716 UA Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.or… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 scanner-ua Cible HTTP GET /nmaplowercheck1794673716 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8056 Chemin / cible /nmaplowercheck1794673716 Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Élevé · 66 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /nmaplowercheck1794673716 HTTP/1.1` User-Agent Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Règles WAF rce-0 ssrf-3 nosqli-3 scanner-ua Payload (extrait) GET /nmaplowercheck1794673716 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.ht Requête brute (extrait) GET /nmaplowercheck1794673716 HTTP/1.1 User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) Host: 62.3.50.33:8056 Connection: close Meta JSON brut {"http_header_count":3,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"03cfbf8c0e86ba291d1d987f1762cc4ae99f24a1","http_host_hash":"294ac2acb4b21ea321d70ac0b666249ea84d8e2b","http_target_hash":"6c8a87111d7a0ee3df0fb4c189803dc275c8a166","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":177,"payload_entropy":5.224885114245969,"port_category":"registered","org":"Google LLC","service":"http","app_proto":"http","asn":396982,"country":"BE","dst_port":8056,"risk_waf":96,"risk_classification":64,"risk_behavior":0,"risk_geo":40,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":6.8,"risk_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30},"risk_score":66,"tag_count":7,"anomaly_count":1,"campaign_key":"350180415e0c9e2f4e0f400a359dc8e9e3ab3e15","event_fingerprint":"86ce671daa1b40a12488ac560ea250c371545614","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":40,"protocol":43,"novelty":30,"risk_score":66,"correlation_boost":23},"named_classification_skipped":fa…

34.78.147.33

Pourquoi listée

Restreindre

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence