IP 37.239.99.144
Décision : Observer
Score max : 32/100 (Faible)
Confiance : 50 %
Période : 2026-10-06 → 2026-11-05 · 2 événements
Motif : Type « Sonde SMB » (signaux protocolaires) · confiance 50%
MITRE : TA0007
FAI : Hulum Almustakbal Company for Communication Engineering and Services Ltd · Irak
Comparaison ASN / FAI
ASN 203214 · 37.239.99.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 2 événements sur la période pour cette IP.
{"protocol_emulated":true,"emulator_response":"00000048","emulator_response_len":4,"bytes_in":73,"payload_entropy":3.5611923625408775,"port_category":"well_known","org":"Hulum Almustakbal Company for Communication Engineering and Services Ltd","service":"smb","app_proto":"smb","asn":203214,"country":"IQ","dst_port":445,"risk_waf":8,"risk_classification":56,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.5,"risk_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":32,"tag_count":2,"anomaly_count":0,"campaign_key":"90eadff6383eb9d1d8f3257adde4c79c467b3287","event_fingerprint":"c2dcd725f3d49cc7233ad16d1772dcd2f3d0439d","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":32},"service_name":"smb","risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"IQ","asn":203214,"org":"Hulum Almustakbal Company for Communication Engineering and Services Ltd","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"98f65ae4490ec634fc2e88ba7dbd9ec1","path_pattern_hash":"b6c073dc229e6284b4cae7886c46d504"},"target_context":{"dst_port":445,"service":"smb","service_name":"smb","risk_score":32},"payl…
TCP
445 · SMB
smb
Sonde SMBsmb probe · via SMB:445 · (sonde / probe)
Élevée
Faible · 21
ÉtapeSonde / probe
ChaîneDécouverte
Personamail.sensor-1.internal
Rôle capteurRenseignement menaces
MITRETA0007DécouverteAccès
Protocole
ÉmulateurSMB
WAF—
RecommandationSurveiller
Tagsnet_smb_probesmb_emulated
Cible HTTP—
TLS SNI—
Capteurparis-1
Preuve / Evidence
Méthode—
Port445
Chemin / cible—
ServiceSMB
Pourquoi cette classification : Type « Sonde SMB » (signaux protocolaires) · confiance 0%
Confiance classification0%
Risque capteurFaible · 21
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé1
Technique MITRETA0007
Tactiques MITREDécouverteAccès initial
User-Agent—
Règles WAF—
Meta JSON brut
{"protocol_emulated":true,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"well_known","org":"Hulum Almustakbal Company for Communication Engineering and Services Ltd","service":"smb","app_proto":"smb","asn":203214,"country":"IQ","dst_port":445,"risk_waf":8,"risk_classification":56,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.5,"risk_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":21,"tag_count":2,"anomaly_count":0,"campaign_key":"90eadff6383eb9d1d8f3257adde4c79c467b3287","event_fingerprint":"c2dcd725f3d49cc7233ad16d1772dcd2f3d0439d","classification_reason":"Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":21},"named_classification_skipped":false,"service_name":"smb","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"IQ","asn":203214,"org":"Hulum Almustakbal Company for Communication Engineering and Services Ltd","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"b6c073dc229e6284b4cae7886c46d504"},"target_context":{"dst_port":445,"service":"smb","service_name":"smb","risk_score":21},"attack_stage":"probe","mitre_tactics":["TA…