{"ip":"44.214.109.203","exported_at":"2026-07-26T04:59:58+00:00","period_days":30,"metrics":{"events7d":0,"distinct_ports":0,"distinct_classifications":0,"max_severity":null,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":82,"attack_stage":"exploit_attempt","attack_chain_stage":"exploitation","threat_family":["unknown"],"recommended_action":"investigate","confidence":0.54,"risk_breakdown":{"waf":100,"classification":80,"behavior":0,"geo":40,"protocol":35,"novelty":30},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"TA0001","top_mitre_technique":"TA0001","top_mitre_count":1807,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP","campaign_hint_fr":null,"confidence_breakdown":{"waf":100,"classification":80,"behavior":0,"geo":40,"protocol":35,"novelty":30,"risk_score":77},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":54,"confidence_hint_fr":null,"sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["CRS-920350"],"tags_summary":["CRS-920350"],"attack_vector":"ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aws%2ephp%2eold","protocol_details":{"http_method":"GET","http_path":"\/aws%2ephp%2eold","request_line":"GET \/aws%2ephp%2eold HTTP\/1.1","http_user_agent":"curl\/8.7.1","port":2401,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"GET \/aws%2ephp%2eold \u00b7 UA curl\/8.7.1 \u00b7 HTTP:2401","evidence_snippet":"GET \/aws%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:2401\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag","target_port_label":"2401 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 54%","classification_reason_label_fr":"Sonde fichier sensible \/ config \u00b7 confiance 54%","confidence_factors_fr":"Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF","payload_preview":"GET \/aws%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:2401\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag"},"events":[{"id":12553659,"ip":"44.214.109.203","ts":"2026-07-16 19:46:02.000000","proto":"tcp","src_port":40134,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/_nodes\/http","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022ff6b945c65ec0157356b158dad63a07259b32811\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 375, \u0022payload_entropy\u0022: 5.1488568029850015, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d976746009944670fcc6e829467fcb0a63ccad45\u0022, \u0022event_fingerprint\u0022: \u0022847cf846bcc7c10858b1b685f54e24a2f3ff9f4d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0344\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ES nodes API\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0344\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00224b77b858789c85cfb5c0205229c9e48c\u0022, \u0022path_pattern_hash\u0022: \u00220b56a35fea8ce0b7c79004682198e73c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/_nodes\/http\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/_nodes\/http\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002293a50992b922415d5e0b7af136669d307526228e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/_nodes\/http\u0022, \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/_nodes\/http\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/_nodes\/http\u0022, \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/_nodes\/http\u0022, \u0022evidence_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":375},{"id":12553660,"ip":"44.214.109.203","ts":"2026-07-16 19:46:02.000000","proto":"tcp","src_port":52740,"dst_port":2401,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/info\/%2eenv%2edist","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u002259b558da015d01f2939764f8733c9dbe19cf209a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 382, \u0022payload_entropy\u0022: 5.161464441838035, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00228692b2125bc1164164dafa3856e1a36ee84a1cd1\u0022, \u0022event_fingerprint\u0022: \u002211401eaf6a725142b5f8f49cd7ec6fb33d341937\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022a1e58969e6612b4f0231fc9cd388b1bc\u0022, \u0022path_pattern_hash\u0022: \u002231e472d70f7d655171121b123169ef03\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ca143f74a07bfa7a0c1f60355b1568ec74810371\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info\/%2eenv%2edist\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info\/%2eenv%2edist\u0022, \u0022evidence_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":382},{"id":12553661,"ip":"44.214.109.203","ts":"2026-07-16 19:46:02.000000","proto":"tcp","src_port":52742,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/sql\/login%2ebak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u002276492cdd4ca7da756b3e84beba8e5086c1d473f4\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.183416744867237, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00224d6983abe19306ef50e876e9b5e3837ffdee63cd\u0022, \u0022event_fingerprint\u0022: \u0022bdec274ec5df77069e8b8378593a3ae0058b77bc\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022e8d9813032fc827c60542e08e40a0fbf\u0022, \u0022path_pattern_hash\u0022: \u0022dbd52cceaf86f6df85e7584a176672f8\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c98dfc110485e56f5feb173f2021590997f36349\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sql\/login%2ebak\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sql\/login%2ebak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12553662,"ip":"44.214.109.203","ts":"2026-07-16 19:46:02.000000","proto":"tcp","src_port":52754,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/aws%2ephp%2eold","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00227387bb51d5104b879d0e99dc9944d1ea1af5fb99\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.163526054330456, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022c5d1352a1374c1808c8eace10bd727dbe58b333b\u0022, \u0022event_fingerprint\u0022: \u0022b297adf9d5dddb9b8f0bc5f3792e09b9538e03ba\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022772d35149185fcd5f53166fe5a9ff6ad\u0022, \u0022path_pattern_hash\u0022: \u00223363573a2f1d6e8551aac742e2f1bbd7\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b9ff4818c377a94130f88b91fe825546dc84d828\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aws%2ephp%2eold\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aws%2ephp%2eold\u0022, \u0022evidence_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12553655,"ip":"44.214.109.203","ts":"2026-07-16 19:46:01.000000","proto":"tcp","src_port":40104,"dst_port":2401,"service":"http","classification":"xss_attack","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/src\/debug%2elog","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022d93981c8b7420d6138ccb6ef0557c8efcff682d3\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.151518573014641, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 74, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00221021e38276441304fb12149472ad986d1839b547\u0022, \u0022event_fingerprint\u0022: \u0022a94aac7cb25ce13387d0d34ca82c8f3a21ad8dff\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 59%\u0022, \u0022confidence\u0022: 0.59, \u0022classification_confidence\u0022: 0.59, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0286\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0286\u0022], \u0022matched_patterns\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 941150\u0022, \u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 74}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 59.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00220ba53aed1bb04c3fa3b4843b4c1a0e8e\u0022, \u0022path_pattern_hash\u0022: \u0022cda7cc188909acc4e69e36a80544397a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 74}, \u0022payload_preview\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 59%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022259cb66f4741826c6e82be4dc2ddcd202efbbe49\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022xss attack \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/debug%2elog\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 59%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 59%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 59, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 74}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 74, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0286\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0286\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022xss attack \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/debug%2elog\u0022, \u0022evidence_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 59 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12553656,"ip":"44.214.109.203","ts":"2026-07-16 19:46:01.000000","proto":"tcp","src_port":40114,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022541f35df5563d54455a41ef0d97f8cde41b7aff9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 403, \u0022payload_entropy\u0022: 5.2332610768466346, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d976746009944670fcc6e829467fcb0a63ccad45\u0022, \u0022event_fingerprint\u0022: \u00226d7d04e4be4b7fe9881f669e8537db2056472720\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022353ca22eae63b48f0173ecc44383199b\u0022, \u0022path_pattern_hash\u0022: \u002203603d0d578626744a99e336209572c9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022817c90db01eeca18746ced191727d4197c437ccb\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":403},{"id":12553657,"ip":"44.214.109.203","ts":"2026-07-16 19:46:01.000000","proto":"tcp","src_port":40120,"dst_port":2401,"service":"http","classification":"backup_file_scan","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/core\/backup\/db%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u002225e87c690d67344e4c2c90367889c6f2c0981fc4\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 384, \u0022payload_entropy\u0022: 5.175228877797256, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 70.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 70.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002241586fba0d26f7fb18d7b6af55721896e94d0bed\u0022, \u0022event_fingerprint\u0022: \u00224500d962ff348a3045668fe53f38e4d2fbc5c913\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab backup_file_scan \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 80, \u0022precision_signals\u0022: [\u0022INT-SEC-backup-files\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-SEC-backup-files\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 70.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022b182909e47be8f50d45644d877ab367a\u0022, \u0022path_pattern_hash\u0022: \u00229003ac5eed01bdea8382e25df338ceeb\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab backup_file_scan \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1552\u0022], \u0022mitre\u0022: \u0022T1552\u0022, \u0022threat_family\u0022: [\u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a69afaaa69c8412001499d2bd68f6943c541fed8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022attack_vector\u0022: \u0022backup file scan \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/backup\/db%2eenv\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab backup_file_scan \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab backup_file_scan \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE T1552 \u2014 confiance 95 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 70.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-SEC-backup-files\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Scan fichiers backup\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1552\u0022, \u0022mitre_technique\u0022: \u0022T1552\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022backup file scan \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/backup\/db%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":384},{"id":12553658,"ip":"44.214.109.203","ts":"2026-07-16 19:46:01.000000","proto":"tcp","src_port":40126,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/tools\/aws%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022651be48e9fdab6a7518117717db25429c13814f0\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.154358168939433, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d976746009944670fcc6e829467fcb0a63ccad45\u0022, \u0022event_fingerprint\u0022: \u0022f9c8eb5db9c4cd4cce2863745715290d6ab91b66\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00224cd53907b03fa7ba30ac99fc881d889b\u0022, \u0022path_pattern_hash\u0022: \u0022c2d7238488913a3bf9ab8e03cfbee1e3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022aa54ed31a9c1cc92eb6a4070d832d320332bd87c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/tools\/aws%2eenv\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/tools\/aws%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12553649,"ip":"44.214.109.203","ts":"2026-07-16 19:46:00.000000","proto":"tcp","src_port":40086,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/core\/secrets\/config%2ejs","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u002209d6a4c994c1f2cff7878cfe15a3080286fbe608\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.158868409677339, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022fd17736d45c73f8ff02194f24a23f9f63a0cd7c2\u0022, \u0022event_fingerprint\u0022: \u002291a66b11f53b7fe0d710ff40a33cb91c1741c169\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022de568a1dd9bace44c10696959ee55acf\u0022, \u0022path_pattern_hash\u0022: \u002285810599d11150068ef74d98ae0af279\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b3d702e83218e76f19a128a91a4599d19a688f3b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/secrets\/config%2ejs\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/secrets\/config%2ejs\u0022, \u0022evidence_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12553651,"ip":"44.214.109.203","ts":"2026-07-16 19:46:00.000000","proto":"tcp","src_port":40092,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/test_phpinfo5%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022f203492862c6fba6dff438691931b373b1815a97\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 383, \u0022payload_entropy\u0022: 5.186676069301, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022734a64ad77a0b65b9ea6a0b61b31abcc7f2bf9f5\u0022, \u0022event_fingerprint\u0022: \u00228a375e438f8d1627f12383e095d7ec392ec9f121\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00224092db5a84775d3d20fa4a465725dccf\u0022, \u0022path_pattern_hash\u0022: \u0022a88015c2c876b7ff39d555606930e0ce\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225d6fe439fd1fcdc2257d2b2df00bccb4e4b3cceb\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/test_phpinfo5%2ephp\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/test_phpinfo5%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":383},{"id":12553652,"ip":"44.214.109.203","ts":"2026-07-16 19:46:00.000000","proto":"tcp","src_port":40096,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/sendgrid_config%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00222155bd174d1ed45ee2ef50cf65e7c826d5a33ee1\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 390, \u0022payload_entropy\u0022: 5.18322238789028, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022c9a8a5b427f6bfdc50c17f9f5a71c12fca8e47eb\u0022, \u0022event_fingerprint\u0022: \u0022b85772394519099ed22706adba214b6529937937\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022a5a498887453a7dcefc966db8ecf163b\u0022, \u0022path_pattern_hash\u0022: \u0022a4039cc7a913ca3c84f0aa59da2f6b35\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226cac86017d83eb1047f61bd1751042c47fc8eb3b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/sendgrid_config%2ejson\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/sendgrid_config%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":390},{"id":12553653,"ip":"44.214.109.203","ts":"2026-07-16 19:46:00.000000","proto":"tcp","src_port":40102,"dst_port":2401,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/static\/debug%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u002262d03db252b7920658fe8de4c5e9c5acd4a1809d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.1778020688655655, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00223275301eb370e14fba81d4696b384b463da6532d\u0022, \u0022event_fingerprint\u0022: \u002217e289ee91fdfdc9559c2928b376305aebd7bb68\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022800434af3f1c1502c7320b78b38b9518\u0022, \u0022path_pattern_hash\u0022: \u0022dd4374e6396725b4a93e496ab548a1f2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022587867780d7e77a49b58f42be546496c954d5d27\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/static\/debug%2eenv\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/static\/debug%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12553642,"ip":"44.214.109.203","ts":"2026-07-16 19:45:59.000000","proto":"tcp","src_port":40052,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/private\/ses%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022f47395e56d3d527db1e3f890f0c3e5ff743b1c96\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 381, \u0022payload_entropy\u0022: 5.150356968985447, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00224d8d5d08c5b1f71418fc3468cf86bf5431331aa7\u0022, \u0022event_fingerprint\u0022: \u00227feb06a4f88e3ce22cd4b262dc0bd74f5d32ce0e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002292208e767df336c43e3450b01001ebf8\u0022, \u0022path_pattern_hash\u0022: \u0022e3edf72b89e306a325c47fe5b53531f3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue\u0022, \u0022payload_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue\u0022, \u0022payload_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002258a9915af492893cc0169e5973d1211498961210\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/private\/ses%2eenv\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/private\/ses%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_private\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_private\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":381},{"id":12553643,"ip":"44.214.109.203","ts":"2026-07-16 19:45:59.000000","proto":"tcp","src_port":40054,"dst_port":2401,"service":"http","classification":"config_file_probe","waf_score":32,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/wp-admin\/network\/ms-plugins%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022d0604bd294cc12c0955a581beca19967e6c52875\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 397, \u0022payload_entropy\u0022: 5.198122696466863, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 21, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00224cf962268592e15329df71d9ab35ee15288b9230\u0022, \u0022event_fingerprint\u0022: \u002264d9ee922785fd83c075f1a6a9c7c4ca39083625\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00229dc399f31dc54b4a7ab63c66605090e3\u0022, \u0022path_pattern_hash\u0022: \u0022e122959fd1e06d1c49586e746fa1e004\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022cms-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP:\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022cms-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP:\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002201a5b045bc12cc57511b92574b1ceea11784935c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_wp_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_wp_scan\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_wp_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_wp_scan\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":397},{"id":12553644,"ip":"44.214.109.203","ts":"2026-07-16 19:45:59.000000","proto":"tcp","src_port":40056,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/decode%2ephp%2eold","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00229176492dea225c37afe64355a4573bac33b15403\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 382, \u0022payload_entropy\u0022: 5.152438107966022, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022c5d1352a1374c1808c8eace10bd727dbe58b333b\u0022, \u0022event_fingerprint\u0022: \u002221cfdf2dee78055a0c50d8df4c4ca5c7deb52bee\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00224a7b8e686cf87a7e2e0e9eb4e0034a9f\u0022, \u0022path_pattern_hash\u0022: \u002232feccaba1604e74f0afb6a05e1e09fe\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222eaf5bf0657e847274bd74d684cc2dc8b87630c7\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/decode%2ephp%2eold\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/decode%2ephp%2eold\u0022, \u0022evidence_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":382},{"id":12553646,"ip":"44.214.109.203","ts":"2026-07-16 19:45:59.000000","proto":"tcp","src_port":40068,"dst_port":2401,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/tmp\/settings%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00228570f8553126c3d30f053cbaf09c38af8a38a09a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 389, \u0022payload_entropy\u0022: 5.17688451543043, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00223275301eb370e14fba81d4696b384b463da6532d\u0022, \u0022event_fingerprint\u0022: \u0022142830af87da9b5c93d58a5bb1ade754f3babb87\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002221c2855b21f5a12301b7bb52a36a166e\u0022, \u0022path_pattern_hash\u0022: \u0022018008c41ceedeb260bc2b30df63430d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bb0235b6d0862903dc6f56e5cda2c05409b34a5c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/tmp\/settings%2ejson\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/tmp\/settings%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":389},{"id":12553648,"ip":"44.214.109.203","ts":"2026-07-16 19:45:59.000000","proto":"tcp","src_port":40070,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api-key_cloudfront%2etxt","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022b780fe5356382fdf7dadb1e9cfa6adc3341b7fad\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.189599762285151, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022734a64ad77a0b65b9ea6a0b61b31abcc7f2bf9f5\u0022, \u0022event_fingerprint\u0022: \u0022ad8ce0ed78cf9043712f6a6f5a21f7a8eef1e0c7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002227329f254e8edb586b0d047c15f1db76\u0022, \u0022path_pattern_hash\u0022: \u0022c8c4be3a6a7f473bb92f01164b059b48\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022694568eb3a07e49571dfb770f6fc2a9ce1981b4b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key_cloudfront%2etxt\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key_cloudfront%2etxt\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12553640,"ip":"44.214.109.203","ts":"2026-07-16 19:45:58.000000","proto":"tcp","src_port":40026,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/config\/sample%2elog","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u002269e910deab36501fd3dadb45398d2e093d905c9e\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 387, \u0022payload_entropy\u0022: 5.173994365364594, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002241a640280739874f1b30c528a6472c5e5528cf28\u0022, \u0022event_fingerprint\u0022: \u0022dc3a5c25ed421287611b9872ddb07409ae74bef7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00224e2e8bdf25ec5b101b5fc1a134f9e908\u0022, \u0022path_pattern_hash\u0022: \u0022da152312ca3e7ae29c060a1dc480166f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225143243a8743a0bcf7eb71d20218769b57f19c86\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/config\/sample%2elog\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/config\/sample%2elog\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":387},{"id":12553641,"ip":"44.214.109.203","ts":"2026-07-16 19:45:58.000000","proto":"tcp","src_port":40036,"dst_port":2401,"service":"http","classification":"backup_file_scan","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/wp-content\/backup\/dbdump%2esql","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022dce844ddad552756948d90ddf939523f6ea20489\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 394, \u0022payload_entropy\u0022: 5.20201662568236, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 70.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 70.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022dbea0a0a95863547f2aa7795450574104098fc5f\u0022, \u0022event_fingerprint\u0022: \u0022d07e0fe54e5362f78ce43ba082fa5aa384dda51f\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 80, \u0022precision_signals\u0022: [\u0022INT-SEC-backup-files\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-SEC-backup-files\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 70.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00224110883e956059fadecae1714a21f509\u0022, \u0022path_pattern_hash\u0022: \u002246401f3dea5961de30c238b6950848a9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 12\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 12\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1552\u0022], \u0022mitre\u0022: \u0022T1552\u0022, \u0022threat_family\u0022: [\u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b2156f275071c5977688e09ef0fc5525b1ffae80\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022attack_vector\u0022: \u0022backup file scan \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-content\/backup\/dbdump%2esql\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE T1552 \u2014 confiance 95 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 70.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-SEC-backup-files\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Scan fichiers backup\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1552\u0022, \u0022mitre_technique\u0022: \u0022T1552\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022backup file scan \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-content\/backup\/dbdump%2esql\u0022, \u0022evidence_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":394},{"id":12553638,"ip":"44.214.109.203","ts":"2026-07-16 19:45:57.000000","proto":"tcp","src_port":39996,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/terraform\/terraform%2etfstate%2elock%2einfo%2econf","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00226fbf3fc997393cd26212322e66f14a1fe80724c9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 414, \u0022payload_entropy\u0022: 5.1900061630965215, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022dbb5d54c31597171184ee7c2ee62187371833070\u0022, \u0022event_fingerprint\u0022: \u00221fa4d36118a05be5eb3b23703dbaef166cc359f9\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022c08b9a06bdbe7c3760f7acfbc14dfc40\u0022, \u0022path_pattern_hash\u0022: \u002265f693b9dd982e63f572314c321f0714\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229e47bbe23b4aec4ada41143bee0a772a3c22ead2\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/terraform\/terraform%2etfstate%2elock%2einfo%2e\u2026\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/terraform\/terraform%2etfstate%2elock%2einfo%2e\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_terraform\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_terraform\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":414},{"id":12553639,"ip":"44.214.109.203","ts":"2026-07-16 19:45:57.000000","proto":"tcp","src_port":40012,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/keys\/config%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022b8dd950a420302c535d9efec2409fc43710b349a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.2025712443391114, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002231558fefcd7a7b1f8d8b9960e916d646b18448a3\u0022, \u0022event_fingerprint\u0022: \u0022bdcb311f0367c69ef0540f2ec0b353e1308463ea\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00226903abc3dc52ac4627b9719d25939f05\u0022, \u0022path_pattern_hash\u0022: \u002271bb9e7055c0f5a6a3f2aa9af9f54af3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002297a67274b0e5eb1df22d0bf36e182f2c946438df\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/keys\/config%2exml\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/keys\/config%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12553634,"ip":"44.214.109.203","ts":"2026-07-16 19:45:56.000000","proto":"tcp","src_port":39940,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/mail\/smtp_credentials%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022ecf190531f1d21f6ce40d24c8bad12751878839b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 396, \u0022payload_entropy\u0022: 5.196604854800913, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022c9a8a5b427f6bfdc50c17f9f5a71c12fca8e47eb\u0022, \u0022event_fingerprint\u0022: \u00220f8513d5ba6dd6a2c061486d4d4e817f3104a8b0\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002222238d561047148b94651144d8c9a7f3\u0022, \u0022path_pattern_hash\u0022: \u00229d651ca2ea14b371bc67173f4063211e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: \u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: \u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d8eb4bfec44c4ef7cd8c6e095bb225832396458d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/mail\/smtp_credentials%2ejson\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/mail\/smtp_credentials%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":396},{"id":12553635,"ip":"44.214.109.203","ts":"2026-07-16 19:45:56.000000","proto":"tcp","src_port":39952,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/db%2emongodump","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00223c63a8750bc7c2b0a13eb48396b0f7eec9aab1e2\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 378, \u0022payload_entropy\u0022: 5.169528313855348, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022734a64ad77a0b65b9ea6a0b61b31abcc7f2bf9f5\u0022, \u0022event_fingerprint\u0022: \u0022bd1c7af54169f385c39f6c5b2249d5e99667cad4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002267ea4b53415d8ba4c525a8b1e669fcff\u0022, \u0022path_pattern_hash\u0022: \u0022fc4dbf1424f0b82f0d46ec2a174d9965\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db%2emongodump\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db%2emongodump\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002216e7212983a73ab3d48658857cf112a70fb0f34a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db%2emongodump\u0022, \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db%2emongodump\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db%2emongodump\u0022, \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db%2emongodump\u0022, \u0022evidence_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":378},{"id":12553636,"ip":"44.214.109.203","ts":"2026-07-16 19:45:56.000000","proto":"tcp","src_port":39964,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/application%2eproperties%2eorig","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022477cda7c156ae739b0777b9d90df8fa17e6663d7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 395, \u0022payload_entropy\u0022: 5.144074548305422, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022734a64ad77a0b65b9ea6a0b61b31abcc7f2bf9f5\u0022, \u0022event_fingerprint\u0022: \u00227e21b15c68240aaa4eee0a19347db2ebd9dd0650\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022c7b461ba8057dc59b7d95ceab76b30e2\u0022, \u0022path_pattern_hash\u0022: \u00223eaf164e6a8c4d1d5558c1b9873068ab\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 1\u0022, \u0022payload_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 1\u0022, \u0022payload_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022574dc6a495c6d3b00637b14f20a47a85b3a028ad\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/application%2eproperties%2eorig\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/application%2eproperties%2eorig\u0022, \u0022evidence_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":395},{"id":12553637,"ip":"44.214.109.203","ts":"2026-07-16 19:45:56.000000","proto":"tcp","src_port":39980,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api-key%2eyml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022b50e237670b086158a8da4c50204316dd18d6d25\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 377, \u0022payload_entropy\u0022: 5.165998755729981, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022734a64ad77a0b65b9ea6a0b61b31abcc7f2bf9f5\u0022, \u0022event_fingerprint\u0022: \u0022bcfe5e451fd9141684be59aee0ef8e15b53c5fd7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022e2260ded5d85f755e2e85a449427c266\u0022, \u0022path_pattern_hash\u0022: \u00228dc423889a8bf4ff9ee47a1f73198c94\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fcd5defc8c9abbc90ffcc09580bff22dc5701429\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key%2eyml\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key%2eyml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":377},{"id":12553630,"ip":"44.214.109.203","ts":"2026-07-16 19:45:55.000000","proto":"tcp","src_port":39892,"dst_port":2401,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/test\/main%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00222683a0217401eb0e58d5fe7eec10204f0e06c3a8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 385, \u0022payload_entropy\u0022: 5.16498088991872, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00223275301eb370e14fba81d4696b384b463da6532d\u0022, \u0022event_fingerprint\u0022: \u0022d9e20c32fe33c14c12f9caa8f72319c6e12c7e1c\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022f70dba8e6a41b40ccfc6d5c39b904310\u0022, \u0022path_pattern_hash\u0022: \u002211679f661efb536d80c1931b06526b9d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222088e0f97359aba7a7ffaa03a609bdb005f31093\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/test\/main%2eenv\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/test\/main%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":385},{"id":12553631,"ip":"44.214.109.203","ts":"2026-07-16 19:45:55.000000","proto":"tcp","src_port":39904,"dst_port":2401,"service":"http","classification":"config_file_probe","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2eenv%2eexample-hotfix","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022743fece80801d4ea4cab1adf80ab535faee6f034\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 387, \u0022payload_entropy\u0022: 5.195898470966858, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022a6c58c674dfc8e5bfaea153ea8b4211169ce2d9e\u0022, \u0022event_fingerprint\u0022: \u002243d8fd853136a1afa0f17a9b2d0bcb6638eb8324\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022a92c9aef97e58b0097d5af4b24735598\u0022, \u0022path_pattern_hash\u0022: \u0022e4a000b7b4be6ad319c134450cae8196\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002250456c5225f0c651480e3cd86423e4dbb1e3d605\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2eenv%2eexample-hotfix\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2eenv%2eexample-hotfix\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":387},{"id":12553632,"ip":"44.214.109.203","ts":"2026-07-16 19:45:55.000000","proto":"tcp","src_port":39916,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/app\/elasticemail%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00223ef7c947081c1beb4061bca77ba7b50faefd2e06\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.162669831274194, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d976746009944670fcc6e829467fcb0a63ccad45\u0022, \u0022event_fingerprint\u0022: \u00228e0c928052d1551b5501142a94cf77eae5b911bb\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00229714cf37973778f0496b473176357ba1\u0022, \u0022path_pattern_hash\u0022: \u0022360aadd960970cd36ff7d3e483dc7910\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a58bd09533fd18120b2ac236bd8f35673409f31b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/app\/elasticemail%2eenv\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/app\/elasticemail%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12553633,"ip":"44.214.109.203","ts":"2026-07-16 19:45:55.000000","proto":"tcp","src_port":39926,"dst_port":2401,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/portal\/%2eenv%2eprod","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022093ebda3dedfdb4a0cf459c6463c195139c940a9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 384, \u0022payload_entropy\u0022: 5.15402305207081, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00228692b2125bc1164164dafa3856e1a36ee84a1cd1\u0022, \u0022event_fingerprint\u0022: \u00227f74dfa4286cd082bba5da48d73453c278d7012a\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022702b5671682978b20a3c21d9f497d1c7\u0022, \u0022path_pattern_hash\u0022: \u0022cdaa04f21ead530e229f84bd2ffd4513\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226a50585228a12f5e0853c8b39e8909aab7434c9c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/portal\/%2eenv%2eprod\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/portal\/%2eenv%2eprod\u0022, \u0022evidence_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":384},{"id":12553626,"ip":"44.214.109.203","ts":"2026-07-16 19:45:54.000000","proto":"tcp","src_port":39860,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022f0d8eecf3e972fd0e3f7a8fce92e2d8d58bd987f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 409, \u0022payload_entropy\u0022: 5.264537268750873, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d976746009944670fcc6e829467fcb0a63ccad45\u0022, \u0022event_fingerprint\u0022: \u002217c15f6f4a53d1089f6caf17196741aa13e4b3cb\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002252cc7c60173177dd65ec795bf2908963\u0022, \u0022path_pattern_hash\u0022: \u0022570e00ca8fa297c6c2ecbda5b086280c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bbc7986b8f76bf161cc571c44b465a48f32aaa45\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":409},{"id":12553627,"ip":"44.214.109.203","ts":"2026-07-16 19:45:54.000000","proto":"tcp","src_port":39866,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/settings%2epy%2eorig","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022e8aa58d373021c43cb2633d417ebd462bc4d5a6d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 384, \u0022payload_entropy\u0022: 5.150738442674941, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022734a64ad77a0b65b9ea6a0b61b31abcc7f2bf9f5\u0022, \u0022event_fingerprint\u0022: \u002239e463deb6d79befcc8a29ab7ccb797c52940939\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022cc468e378bd80f48d17ce206b41cbdc4\u0022, \u0022path_pattern_hash\u0022: \u002211582cbdb6718d89141ec3d325abff39\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f67aa8b027e4cd2c258fa5fcaffc0e637a1abdcb\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/settings%2epy%2eorig\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/settings%2epy%2eorig\u0022, \u0022evidence_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":384},{"id":12553628,"ip":"44.214.109.203","ts":"2026-07-16 19:45:54.000000","proto":"tcp","src_port":39882,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/public\/config%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00220384df45554daec98d08f86ba73f2432f210c731\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 387, \u0022payload_entropy\u0022: 5.196762192159299, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e842340553379c6c00d4b82ddb16be8ecf9c81f3\u0022, \u0022event_fingerprint\u0022: \u00226080c98d91046a47d61f4ba7e29369b0114f06c9\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022fd394387693ae1d992837c8366d9d01a\u0022, \u0022path_pattern_hash\u0022: \u0022c66eae166966f1c8bc6680c13b79086c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ed9e82d1da435e23ed6ab17a3622198900d8cc8e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/public\/config%2exml\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/public\/config%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":387},{"id":12553629,"ip":"44.214.109.203","ts":"2026-07-16 19:45:54.000000","proto":"tcp","src_port":39890,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/info4%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00225b799c4b6ebcc4b3a9438741142d022a47b5d659\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 375, \u0022payload_entropy\u0022: 5.162513070267719, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022734a64ad77a0b65b9ea6a0b61b31abcc7f2bf9f5\u0022, \u0022event_fingerprint\u0022: \u00229fe8d81e52fd57eb4c66ff98e30783d500365226\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00227eea67f94c5042c9e05744e12f639753\u0022, \u0022path_pattern_hash\u0022: \u0022aa6001943d9690d57e8a283353e2a677\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info4%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info4%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a4b3e65743079dd667a98c515936dce6274fe7d7\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info4%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info4%2ephp\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info4%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info4%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":375},{"id":12553618,"ip":"44.214.109.203","ts":"2026-07-16 19:45:53.000000","proto":"tcp","src_port":39824,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/core\/sql\/settings%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022f713e687d10b1ef89cde41580dd4b64d36c1112d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.160262967626567, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002246089d9bbd2df68dd91a8aab763734b27af57f08\u0022, \u0022event_fingerprint\u0022: \u0022abb71b5a778e4c5b2c28422a8de43528a5699039\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022a72ebf745e630d2a88b230a19d47406f\u0022, \u0022path_pattern_hash\u0022: \u0022f695599c426f3fa01dfc982b4508daaa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bcefa43b5eb30a91f91330f928db8446faa73908\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/sql\/settings%2ejson\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/sql\/settings%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12553620,"ip":"44.214.109.203","ts":"2026-07-16 19:45:53.000000","proto":"tcp","src_port":39830,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/mailgun\/sendgrid_api_key%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00222be079332c04ba6dfd68b21873fe837316b2d866\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 401, \u0022payload_entropy\u0022: 5.221181302738902, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022ba9404a5e74ba5aafd88daf1bfa32d528804126f\u0022, \u0022event_fingerprint\u0022: \u0022778c1bd38bedf1607ed88c363d04e0b3c9c589f8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022e974e0c7ca577c93b261f5e99ec64d50\u0022, \u0022path_pattern_hash\u0022: \u0022d1f7a6c60f176de79efd6cf86e101bb6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227040e4178088c3185ae4d2bad0f43336c0d3862c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":401},{"id":12553622,"ip":"44.214.109.203","ts":"2026-07-16 19:45:53.000000","proto":"tcp","src_port":39836,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/secrets\/settings%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u002294a893c5793b7963caf14b2735bdb6517354bc00\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 390, \u0022payload_entropy\u0022: 5.147720073274325, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00228072e8ea1896501f4eb45d7131be5b91e2fe2379\u0022, \u0022event_fingerprint\u0022: \u0022fff5b581cb0fc9e7240dbce44aede587540e815d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022380a111f01c6b49fc3d676944189fcc9\u0022, \u0022path_pattern_hash\u0022: \u00227f8aef03e9383566f2641607540d417b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022670edcc86cbe7579592b29110b1320217fe5812c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/secrets\/settings%2eenv\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/secrets\/settings%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":390},{"id":12553623,"ip":"44.214.109.203","ts":"2026-07-16 19:45:53.000000","proto":"tcp","src_port":39838,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/armnn\/env%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00223018cb95243bc16776e28bb51ebdab0add14eda7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.151729416055063, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d976746009944670fcc6e829467fcb0a63ccad45\u0022, \u0022event_fingerprint\u0022: \u00223f0a650071de706b753c2eeeb3daf5b3113e6834\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022fa6c7071e37ac10790686dd0d4d4d8b4\u0022, \u0022path_pattern_hash\u0022: \u0022dd5aea81f1e2902d0553a9e84ef93dc3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022db9a3cd7198e027c1b10ef31f1f5fb8001c11c73\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/armnn\/env%2eenv\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/armnn\/env%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12553625,"ip":"44.214.109.203","ts":"2026-07-16 19:45:53.000000","proto":"tcp","src_port":39848,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/sample%2ebak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u002250aaaa9aa133d35fa3aa95c51c475620f1e9001c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 383, \u0022payload_entropy\u0022: 5.1851195590526915, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00224d6983abe19306ef50e876e9b5e3837ffdee63cd\u0022, \u0022event_fingerprint\u0022: \u002298b0aeee459dc42403263354e710504f231dd2a0\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002217987bbf57ec98e1ea276a370b80c83b\u0022, \u0022path_pattern_hash\u0022: \u00228d06070e9c9922e376f5a87aad4d0fab\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002226d74d577c8636bc2cb40e9e8047811d5e04e2bd\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sample%2ebak\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sample%2ebak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":383},{"id":12553613,"ip":"44.214.109.203","ts":"2026-07-16 19:45:52.000000","proto":"tcp","src_port":8804,"dst_port":2401,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/publics\/%2egit\/config","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022dffdd03c5a3f6000d7374bbeda953224c20b9853\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 385, \u0022payload_entropy\u0022: 5.170181769227318, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022c1df7743dca058f0fe1f483ac0d9f7faac9bd73f\u0022, \u0022event_fingerprint\u0022: \u0022b574c3e0c4e2b6b94c619398482f98e990f71990\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022dc1e2be1d87a31303a8377a63a5d0ae1\u0022, \u0022path_pattern_hash\u0022: \u0022c022a7a77ca5d3c8e53e008c45692091\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-0\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-0\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225fd12aa620543460937d163e884a57cdaf708e6d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/publics\/%2egit\/config\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/publics\/%2egit\/config\u0022, \u0022evidence_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_git_exposure\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_git_exposure\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":385},{"id":12553614,"ip":"44.214.109.203","ts":"2026-07-16 19:45:52.000000","proto":"tcp","src_port":39792,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2essh\/public%2ecrt%2ebak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00224161c777803c6e2a426033a05cdb91ccfb36ebb7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 389, \u0022payload_entropy\u0022: 5.1902537496897505, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022ce08049b5da01db42c7fbc2859ba6a71e0eb942c\u0022, \u0022event_fingerprint\u0022: \u0022e34f73f7d33c01710e75ba0e53f359be9520e9b0\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022b2ef3204c863bb983f4a4122f4d94c93\u0022, \u0022path_pattern_hash\u0022: \u0022531a9de251d1f71df3608b911075179f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2essh\/public%2ecrt%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2essh\/public%2ecrt%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022338e6118ce8a42c8665c28dd649ef45ca8f8bf5a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2essh\/public%2ecrt%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2essh\/public%2ecrt%2ebak\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2essh\/public%2ecrt%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2essh\/public%2ecrt%2ebak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2essh\/public%2ecrt%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":389},{"id":12553615,"ip":"44.214.109.203","ts":"2026-07-16 19:45:52.000000","proto":"tcp","src_port":39800,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/server\/laravel\/docker-compose%2eglobal%2eyml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00227f07050fb319bb1f0c743200b0485d27a42e3cdd\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 408, \u0022payload_entropy\u0022: 5.21520943529401, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d976746009944670fcc6e829467fcb0a63ccad45\u0022, \u0022event_fingerprint\u0022: \u0022e4798b005b31f3f3c6ae2d245638d12e274ab605\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002202ac343121071d577b9e27b8d061eb0b\u0022, \u0022path_pattern_hash\u0022: \u0022d8daca7d08ee459742540f7e5191601e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-E\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX\u0022, \u0022payload_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-E\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX\u0022, \u0022payload_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-E\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226c5f721949c22541cfcd76567a9c7b731ea71fd7\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-E\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/server\/laravel\/docker-compose%2eglobal%2eyml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2eglobal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-E\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":408},{"id":12553616,"ip":"44.214.109.203","ts":"2026-07-16 19:45:52.000000","proto":"tcp","src_port":39814,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/slack_api_key%2etxt","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00224f67881f111a3db188813e19a5fedf72fc20a61a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 383, \u0022payload_entropy\u0022: 5.191557203272761, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022734a64ad77a0b65b9ea6a0b61b31abcc7f2bf9f5\u0022, \u0022event_fingerprint\u0022: \u0022e8899e8399f0d1071b73dd1f3e8fdbadab1931d1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022e6e8655e23428e9b8994b821ac55520e\u0022, \u0022path_pattern_hash\u0022: \u0022997b6c777514621d5fc0db4f7df9b95e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d540705a194b4a624218a45cbdee57c9969de88e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/slack_api_key%2etxt\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/slack_api_key%2etxt\u0022, \u0022evidence_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":383},{"id":12553609,"ip":"44.214.109.203","ts":"2026-07-16 19:45:51.000000","proto":"tcp","src_port":8782,"dst_port":2401,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/live\/%2eenv%2estaging","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022eef3d069f0cc60d79bbb0686c812fac8298771e0\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 385, \u0022payload_entropy\u0022: 5.155652937458361, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 75, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002281f35fd83df0182caaba4a3872f9c3186cadedf6\u0022, \u0022event_fingerprint\u0022: \u00220c90a13a03d1ceb34a395eba10f7c115168e91b2\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.5, \u0022classification_confidence\u0022: 0.5, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 75}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022b3180cbbb183c4e1897a08927617d2b8\u0022, \u0022path_pattern_hash\u0022: \u0022c48c1b047d9c9ede8ca027bd7afa77df\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 75}, \u0022payload_preview\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/live\/%2eenv%2estaging\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/live\/%2eenv%2estaging\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221a9dfacae4e79963a84f5662ae267b11796d835b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/live\/%2eenv%2estaging\u0022, \u0022request_line\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/live\/%2eenv%2estaging\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 75}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 75, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/live\/%2eenv%2estaging\u0022, \u0022request_line\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/live\/%2eenv%2estaging\u0022, \u0022evidence_snippet\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_live\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_live\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":385},{"id":12553610,"ip":"44.214.109.203","ts":"2026-07-16 19:45:51.000000","proto":"tcp","src_port":8788,"dst_port":2401,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/payment-app\/api\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00225a2b53ab33b90300214cb62365a512ab49f441a6\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.171113013263584, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00228692b2125bc1164164dafa3856e1a36ee84a1cd1\u0022, \u0022event_fingerprint\u0022: \u00221062f1543c5e64e2dd68039f9c9b49608cc63246\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022509908dbd5a79f3a404b05e1a8f1b754\u0022, \u0022path_pattern_hash\u0022: \u00225dd6ccc5ca99af94dc94d2ea0f2b77a5\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/payment-app\/api\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/payment-app\/api\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228169ff9a0072c8ef38858bd1cb95b5ec1d9d2558\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/payment-app\/api\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/payment-app\/api\/%2eenv\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/payment-app\/api\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/payment-app\/api\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12553611,"ip":"44.214.109.203","ts":"2026-07-16 19:45:51.000000","proto":"tcp","src_port":8792,"dst_port":2401,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/custom\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u002283345ee7b16d1d2aa90988b373c2a7cb2bbaed12\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 377, \u0022payload_entropy\u0022: 5.156067588772555, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00228692b2125bc1164164dafa3856e1a36ee84a1cd1\u0022, \u0022event_fingerprint\u0022: \u0022fe61aa1671ad6df6af40825b1f18e83546e34e68\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002220b77e8d0e66523dea502d8c7505c7c1\u0022, \u0022path_pattern_hash\u0022: \u00224e59106525e243287c9376964c3f2170\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022126efddb3a640224a0539c15d7b2fb16c5f6f102\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/custom\/%2eenv\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/custom\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":377},{"id":12553612,"ip":"44.214.109.203","ts":"2026-07-16 19:45:51.000000","proto":"tcp","src_port":8796,"dst_port":2401,"service":"http","classification":"ssrf_internal","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/new\/info%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00223be98612c14adf93fb1cfe89830f0d980f09dbab\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 378, \u0022payload_entropy\u0022: 5.160744337939539, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 77, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d976746009944670fcc6e829467fcb0a63ccad45\u0022, \u0022event_fingerprint\u0022: \u0022dbcd25688d327ebdd52304b3f5a26c4ff7466f21\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022confidence\u0022: 0.54, \u0022classification_confidence\u0022: 0.54, \u0022precision_score\u0022: 64, \u0022precision_signals\u0022: [\u0022CRS-920350\u0022], \u0022kb_rule_ids\u0022: [\u0022CRS-920350\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022ssrf_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 54.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022b2764b9f7916e6bf614f70cf9501ce6b\u0022, \u0022path_pattern_hash\u0022: \u0022a7a9f5c2684b775940252b03aea345bb\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 77}, \u0022payload_preview\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b2ca009ebed86d84a7adae90b91881f777011137\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/new\/info%2ephp\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 54, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 77}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 77, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022CRS-920350\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022CRS-920350\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022ssrf internal \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/new\/info%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":378},{"id":12553604,"ip":"44.214.109.203","ts":"2026-07-16 19:45:50.000000","proto":"tcp","src_port":8740,"dst_port":2401,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/config\/settings%2eyml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022e0cd3da1e9ceb9495dca5d8a9936d6b995ebf201\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 391, \u0022payload_entropy\u0022: 5.188391993075149, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00223275301eb370e14fba81d4696b384b463da6532d\u0022, \u0022event_fingerprint\u0022: \u00226e040b0ee3d22c7636ea3e09fd551541fedbb27e\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002264c8dafb5844ab055a3f8c6410c1c40f\u0022, \u0022path_pattern_hash\u0022: \u002237329233134a81eb31a2e80267f34085\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/config\/settings%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/config\/settings%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fff097201a1156348b8f19f92e255287e88a254e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/config\/settings%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/config\/settings%2eyml\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/config\/settings%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/config\/settings%2eyml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":391},{"id":12553605,"ip":"44.214.109.203","ts":"2026-07-16 19:45:50.000000","proto":"tcp","src_port":8754,"dst_port":2401,"service":"http","classification":"config_file_probe","waf_score":45,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/bot\/%2eenv%2ebak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022436590482694e8e3a458ea0154cc9f648da77b7e\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 380, \u0022payload_entropy\u0022: 5.170171648517065, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 22, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d029d73ee6eef1dd84976bc1cee1443b220a1322\u0022, \u0022event_fingerprint\u0022: \u0022bddb5b3be43670193d0e86fbb99c35fe57b473a8\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022e22755ec89592b13f815039203bfea15\u0022, \u0022path_pattern_hash\u0022: \u0022846f757714e155dd7260c351bd4e596e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/bot\/%2eenv%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-\u0022, \u0022payload_snippet\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/bot\/%2eenv%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-\u0022, \u0022payload_snippet\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229d09f73c7bb2891655657389d5a0eefa627bce32\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/bot\/%2eenv%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/bot\/%2eenv%2ebak\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 7 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/bot\/%2eenv%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/bot\/%2eenv%2ebak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 7 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022botnet_http_c2\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022botnet_http_c2\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":380},{"id":12553606,"ip":"44.214.109.203","ts":"2026-07-16 19:45:50.000000","proto":"tcp","src_port":8770,"dst_port":2401,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/master\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u0022a57464b29ecbac66ddd4b4e36d7a9af73b3c29d2\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 377, \u0022payload_entropy\u0022: 5.150844751576409, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00228692b2125bc1164164dafa3856e1a36ee84a1cd1\u0022, \u0022event_fingerprint\u0022: \u00220d3aff3a3a840c7cc63463d625d9297d8d09b2c1\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002258f3e0c2e2e0ac1e1f2129e7814adace\u0022, \u0022path_pattern_hash\u0022: \u00224cc262daae84eae4ecf616019075e632\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/master\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/master\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dc06fab96618d669bccb4338787a2a9159416366\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/master\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/master\/%2eenv\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/master\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/master\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":377},{"id":12553607,"ip":"44.214.109.203","ts":"2026-07-16 19:45:50.000000","proto":"tcp","src_port":8772,"dst_port":2401,"service":"http","classification":"xss_attack","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/src\/main\/resources\/harness%2eproperties","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 4, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022453bf29a76f3e411f8b6f9fe287aeac974f2f6f5\u0022, \u0022http_target_hash\u0022: \u00224a7c51fbeb33f889cf65afd1aef7fc451fd88c69\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 403, \u0022payload_entropy\u0022: 5.165898572724105, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 14618, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 2401, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 74, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d976746009944670fcc6e829467fcb0a63ccad45\u0022, \u0022event_fingerprint\u0022: \u0022ea02f6aa58391f518a72f92870296fb6d6f47651\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022confidence\u0022: 0.59, \u0022classification_confidence\u0022: 0.59, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0286\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0286\u0022], \u0022matched_patterns\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 941150\u0022, \u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 74}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 59.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 14618, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00229bc469b7a586c0e38f4c3ee3d3cd473d\u0022, \u0022path_pattern_hash\u0022: \u00227ce39adf2c85187b760d41b6bdc4487a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 74}, \u0022payload_preview\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/main\/resources\/harness%2eproperties\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/main\/resources\/harness%2eproperties\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226e9b1ca9aa3fc6fe21e8bfb4e978171b7c416235\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/main\/resources\/harness%2eproperties\u0022, \u0022request_line\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022attack_vector\u0022: \u0022xss attack \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/main\/resources\/harness%2eproperties\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 59, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 74}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 74, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 2401, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0286\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0286\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/main\/resources\/harness%2eproperties\u0022, \u0022request_line\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 2401, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022xss attack \u00b7 via HTTP:2401 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/main\/resources\/harness%2eproperties\u0022, \u0022evidence_snippet\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\\r\\nHost: 62.3.50.33:2401\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022target_port_label\u0022: \u00222401 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 59 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222401\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:2401","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":403}],"total_events":3000}