Détails IP 44.220.185.41

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « x11-2 » (signaux protocolaires) · confiance 0%

Confiance faible (0 %) — classification prudente

Comparaison ASN / FAI

ASN 16509 · 44.192.0.0/10 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 5 événements sur la période pour cette IP.

18.227.107.145 vnc bruteforce 28/07/2026 08:54 UTC
18.188.83.55 vnc bruteforce 28/07/2026 08:53 UTC
3.15.211.188 vnc bruteforce 28/07/2026 08:48 UTC
13.200.181.89 vnc bruteforce 28/07/2026 08:42 UTC
16.58.56.214 Sonde PostgreSQL 28/07/2026 08:40 UTC
3.129.187.38 Sonde PostgreSQL 28/07/2026 08:38 UTC
18.116.101.220 Sonde port 23/TCP 28/07/2026 08:28 UTC
3.131.220.121 Sonde PostgreSQL 28/07/2026 08:27 UTC

IPs apparentées

Même FAI Amazon.com, Inc. — corrélation indicative.

18.227.107.145 vnc bruteforce
18.188.83.55 vnc bruteforce
3.15.211.188 vnc bruteforce
13.200.181.89 vnc bruteforce
16.58.56.214 Sonde PostgreSQL

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

5 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
12/07/2026 16:08:48 UTC	TCP	6002 · X11 2	x11-2	x11-2 x11-2 · via X11 2:6002 · (sonde / probe)	Faible	Faible · 1
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur X11-2 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6002 Chemin / cible — Service X11 2 Pourquoi cette classification : Type « x11-2 » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 1 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74207831315f3220726561647920706f72743d363030320d0a", "emulator_response_len": 36, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Amazon.com, Inc.", "service": "x11-2", "app_proto": "x11-2", "asn": 14618, "country": "US", "dst_port": 6002, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0 }, "risk_score": 1, "tag_count": 0, "anomaly_count": 0, "campaign_key": "e7d282a0ec19c46689c9e64b2d1946d47190a742", "event_fingerprint": "48f3321cd2ff669cc459d0416d74b754cdcc79de", "classification_reason": "Type \u00ab x11-2 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0, "risk_score": 1 }, "named_classification_skipped": false, "service_name": "x11-2", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14618, "org": "Amazon.com, Inc.", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "db0b049a283e8c56ee1d83545ddd27af" }, "target_context": { "dst_port": 6002, "service": "x11-2", "service_name": "x11-2", "risk_score": 1 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "45f6944fde49748263403f07ca378198f90710cc", "protocol_details": { "port": 6002, "service": "x11-2", "service_label_fr": "X11 2" }, "attack_vector": "x11-2 \u00b7 via X11 2:6002 \u00b7 (sonde \/ probe)", "target_port_label": "6002 \u00b7 X11 2", "emulator_service": "x11-2", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab x11-2 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab x11-2 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0, "risk_score": 1 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 1, "risk_label": "Faible", "service_name": "x11-2", "service_label_fr": "X11 2", "dst_port": 6002, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-x11-2", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 6002, "service": "x11-2", "service_label_fr": "X11 2" }, "attack_vector": "x11-2 \u00b7 via X11 2:6002 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "6002 \u00b7 X11 2", "emulator_service": "x11-2", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "x11_2", "service_banner": "honeypot-x11-2", "service_os": "linux", "dst_port": "6002" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
12/07/2026 16:08:41 UTC	TCP	6002 · X11 2	x11-2	x11-2 x11-2 · via X11 2:6002 · (sonde / probe)	Faible	Faible · 1
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur X11-2 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6002 Chemin / cible — Service X11 2 Pourquoi cette classification : Type « x11-2 » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 1 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74207831315f3220726561647920706f72743d363030320d0a", "emulator_response_len": 36, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Amazon.com, Inc.", "service": "x11-2", "app_proto": "x11-2", "asn": 14618, "country": "US", "dst_port": 6002, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0 }, "risk_score": 1, "tag_count": 0, "anomaly_count": 0, "campaign_key": "e7d282a0ec19c46689c9e64b2d1946d47190a742", "event_fingerprint": "48f3321cd2ff669cc459d0416d74b754cdcc79de", "classification_reason": "Type \u00ab x11-2 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0, "risk_score": 1 }, "named_classification_skipped": false, "service_name": "x11-2", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14618, "org": "Amazon.com, Inc.", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "db0b049a283e8c56ee1d83545ddd27af" }, "target_context": { "dst_port": 6002, "service": "x11-2", "service_name": "x11-2", "risk_score": 1 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "45f6944fde49748263403f07ca378198f90710cc", "protocol_details": { "port": 6002, "service": "x11-2", "service_label_fr": "X11 2" }, "attack_vector": "x11-2 \u00b7 via X11 2:6002 \u00b7 (sonde \/ probe)", "target_port_label": "6002 \u00b7 X11 2", "emulator_service": "x11-2", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab x11-2 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab x11-2 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0, "risk_score": 1 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 1, "risk_label": "Faible", "service_name": "x11-2", "service_label_fr": "X11 2", "dst_port": 6002, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-x11-2", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 6002, "service": "x11-2", "service_label_fr": "X11 2" }, "attack_vector": "x11-2 \u00b7 via X11 2:6002 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "6002 \u00b7 X11 2", "emulator_service": "x11-2", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "x11_2", "service_banner": "honeypot-x11-2", "service_os": "linux", "dst_port": "6002" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
12/07/2026 16:08:40 UTC	TCP	6002 · X11 2	x11-2	Botnet Mozi mozi pattern · via X11 2:6002 · (commande & contrôle)	Élevée	Moyen · 43
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur X11-2 WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6002 Chemin / cible — Service X11 2 Payload GET / HTTP/1.1 Host: 62.3.50.33:6002 User-Agent: Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Moyen · 43 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE TA0011 User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6002 User-Agent: Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6002 User-Agent: Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3064.68 Safari/537.32 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74207831315f3220726561647920706f72743d363030320d0a", "emulator_response_len": 36, "bytes_in": 234, "payload_entropy": 5.381735435223355, "port_category": "registered", "org": "Amazon.com, Inc.", "service": "x11-2", "app_proto": "x11-2", "asn": 14618, "country": "US", "dst_port": 6002, "risk_waf": 8, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "e89ed91193c6c38411b081b9603248c27c615c04", "event_fingerprint": "92a505b7a4b1ed70159d9f97054b022dcfe7159c", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15, "risk_score": 43 }, "named_classification_skipped": false, "service_name": "x11-2", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14618, "org": "Amazon.com, Inc.", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0da9f0a1bd03c894cebef2fb1228fca7", "path_pattern_hash": "762d384fab941f6d0c2239f19994f30e" }, "target_context": { "dst_port": 6002, "service": "x11-2", "service_name": "x11-2", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) ", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/51.0.3064.68 Safari\/537.32\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko)", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/51.0.3064.68 Safari\/537.32\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko)", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e206d8cacc9c0587c30ee102f4939dfd182ae3e3", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko)", "port": 6002, "service": "x11-2", "service_label_fr": "X11 2" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko)", "attack_vector": "mozi pattern \u00b7 via X11 2:6002 \u00b7 (commande & contr\u00f4le)", "target_port_label": "6002 \u00b7 X11 2", "emulator_service": "x11-2", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0011 \u2014 via X11 2", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15, "risk_score": 43 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 43, "risk_label": "Moyen", "service_name": "x11-2", "service_label_fr": "X11 2", "dst_port": 6002, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-x11-2", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko)", "port": 6002, "service": "x11-2", "service_label_fr": "X11 2" }, "attack_vector": "mozi pattern \u00b7 via X11 2:6002 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6002\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko)", "target_port_label": "6002 \u00b7 X11 2", "emulator_service": "x11-2", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "x11_2", "service_banner": "honeypot-x11-2", "service_os": "linux", "dst_port": "6002" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ], "asn_dc_heuristic": true }
12/07/2026 16:08:40 UTC	TCP	6002 · X11 2	x11-2	SSRF interne ssrf internal · via X11 2:6002 · (tentative d'exploit)	Élevée	Moyen · 53
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur X11-2 WAF — Recommandation Investiguer Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6002 Chemin / cible — Service X11 2 Payload GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3064.68 Saf Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54% Confiance classification 54% Risque capteur Moyen · 53 Confiance : Confiance 54 % — Motif catalogue confirmé Protocole émulé 1 Signaux CRS-920350 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3064.68 Saf Requête brute (extrait) GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3064.68 Safari/537.32 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Host: localhost Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74207831315f3220726561647920706f72743d363030320d0a", "emulator_response_len": 36, "bytes_in": 228, "payload_entropy": 5.386609000496767, "port_category": "registered", "org": "Amazon.com, Inc.", "service": "x11-2", "app_proto": "x11-2", "asn": 14618, "country": "US", "dst_port": 6002, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15 }, "risk_score": 53, "tag_count": 3, "anomaly_count": 0, "campaign_key": "e89ed91193c6c38411b081b9603248c27c615c04", "event_fingerprint": "92a505b7a4b1ed70159d9f97054b022dcfe7159c", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "confidence": 0.54, "classification_confidence": 0.54, "precision_score": 64, "precision_signals": [ "CRS-920350" ], "kb_rule_ids": [ "CRS-920350" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15, "risk_score": 53 }, "named_classification_skipped": false, "classification_parent": "ssrf_attack", "service_name": "x11-2", "risk_confidence_factor": 54, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14618, "org": "Amazon.com, Inc.", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "98c146f0cdaabec6bd64053558f2fea0", "path_pattern_hash": "2926fa5ba65a298fe7630f4e1d1dd6ea" }, "target_context": { "dst_port": 6002, "service": "x11-2", "service_name": "x11-2", "risk_score": 53 }, "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/51.0.3064.68 Saf", "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/51.0.3064.68 Safari\/537.32\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nHost: localhost\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/51.0.3064.68 Saf", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/51.0.3064.68 Safari\/537.32\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nHost: localhost\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/51.0.3064.68 Saf", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cdbca17d359b87ab3bff9ea505da307ec507dd49", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/51.0.3064.68 Saf", "port": 6002, "service": "x11-2", "service_label_fr": "X11 2" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/51.0.3064.68 Saf", "attack_vector": "ssrf internal \u00b7 via X11 2:6002 \u00b7 (tentative d'exploit)", "target_port_label": "6002 \u00b7 X11 2", "emulator_service": "x11-2", "confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via X11 2", "confidence_pct": 54, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15, "risk_score": 53 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 53, "risk_label": "Moyen", "service_name": "x11-2", "service_label_fr": "X11 2", "dst_port": 6002, "protocol_emulated": true, "tags_summary": [ "CRS-920350" ], "tags_summary_labels_fr": [ "CRS-920350" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-x11-2", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/51.0.3064.68 Saf", "port": 6002, "service": "x11-2", "service_label_fr": "X11 2" }, "attack_vector": "ssrf internal \u00b7 via X11 2:6002 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/51.0.3064.68 Saf", "target_port_label": "6002 \u00b7 X11 2", "emulator_service": "x11-2", "confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "x11_2", "service_banner": "honeypot-x11-2", "service_os": "linux", "dst_port": "6002" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ], "asn_dc_heuristic": true }
12/07/2026 16:08:40 UTC	TCP	6002 · X11 2	x11-2	x11-2 x11-2 · via X11 2:6002 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur X11-2 WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6002 Chemin / cible — Service X11 2 Payload :fq��)��J�u� ��V�j��ܰ�H/ t9)��W��!�B�/wNܟ��r�H�,�0�+�/̨̩��̪��$�(�#�'� �� k Pourquoi cette classification : Type « x11-2 » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) :fq��)��J�u��V�j��ܰ�H/ t9)��W��!�B�/wNܟ��r�H�,�0�+�/̨̩��̪��$�(�#�'� �� k Requête brute (extrait) :fq��)��J�u� ��V�j��ܰ�H/ t9)��W��!�B�/wNܟ��r�H�,�0�+�/̨̩��̪��$�(�#�'� �� kg93��=<5/~� � http/1.11 64 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74207831315f3220726561647920706f72743d363030320d0a", "emulator_response_len": 36, "bytes_in": 1560, "payload_entropy": 7.702628488537718, "port_category": "registered", "org": "Amazon.com, Inc.", "service": "x11-2", "app_proto": "x11-2", "asn": 14618, "country": "US", "dst_port": 6002, "risk_waf": 8, "risk_classification": 24, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "f11d64d13e4d0d91903eff4ae9e2f31e4010dd13", "event_fingerprint": "48f3321cd2ff669cc459d0416d74b754cdcc79de", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab x11-2 \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 35 }, "service_name": "x11-2", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14618, "org": "Amazon.com, Inc.", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a465ed36ceea6788152e615852cea1eb", "path_pattern_hash": "db0b049a283e8c56ee1d83545ddd27af" }, "target_context": { "dst_port": 6002, "service": "x11-2", "service_name": "x11-2", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0006\u0013\u0001\u0000\u0006\u000f\u0003\u0003\n\r\f:\u0002f\u0013q\ufffd\ufffd\ufffd)\ufffd\ufffdJ\ufffdu\ufffd\u000b\ufffd\ufffdV\ufffdj\ufffd\ufffd\ufffd\u0730\ufffdH\/ t9)\ufffd\ufffd\ufffd\ufffd\ufffdW\u0001\ufffd\ufffd\u0006\ufffd\ufffd\ufffd!\ufffdB\ufffd\/wN\u071f\ufffd\u001c\ufffd\u0085r\ufffd\u0000H\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\u0000\ufffd\u0000\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0000k", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\u0013\u0001\u0000\u0006\u000f\u0003\u0003\n\r\f:\u0002f\u0013q\ufffd\ufffd\ufffd)\ufffd\ufffdJ\ufffdu\ufffd\u000b\ufffd\ufffdV\ufffdj\ufffd\ufffd\ufffd\u0730\ufffdH\/ t9)\ufffd\ufffd\ufffd\ufffd\ufffdW\u0001\ufffd\ufffd\u0006\ufffd\ufffd\ufffd!\ufffdB\ufffd\/wN\u071f\ufffd\u001c\ufffd\u0085r\ufffd\u0000H\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\u0000\ufffd\u0000\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0000k\u0000g\u00009\u00003\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u0000<\u00005\u0000\/\u0001\u0000\u0005~\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u00006\u00004\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006", "payload_snippet": "\u0016\u0003\u0001\u0006\u0013\u0001\u0000\u0006\u000f\u0003\u0003\n\r\f:\u0002f\u0013q\ufffd\ufffd\ufffd)\ufffd\ufffdJ\ufffdu\ufffd\u000b\ufffd\ufffdV\ufffdj\ufffd\ufffd\ufffd\u0730\ufffdH\/ t9)\ufffd\ufffd\ufffd\ufffd\ufffdW\u0001\ufffd\ufffd\u0006\ufffd\ufffd\ufffd!\ufffdB\ufffd\/wN\u071f\ufffd\u001c\ufffd\u0085r\ufffd\u0000H\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\u0000\ufffd\u0000\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0000k", "classification_reason": "Type \u00ab x11-2 \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e89b6a87a8e765d21ed325b3898665b30a525a03", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\u0013\u0001\u0000\u0006\u000f\u0003\u0003\n\r\f:\u0002f\u0013q\ufffd\ufffd\ufffd)\ufffd\ufffdJ\ufffdu\ufffd\u000b\ufffd\ufffdV\ufffdj\ufffd\ufffd\ufffd\u0730\ufffdH\/ t9)\ufffd\ufffd\ufffd\ufffd\ufffdW\u0001\ufffd\ufffd\u0006\ufffd\ufffd\ufffd!\ufffdB\ufffd\/wN\u071f\ufffd\u001c\ufffd\u0085r\ufffd\u0000H\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\u0000\ufffd\u0000\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0000k", "port": 6002, "service": "x11-2", "service_label_fr": "X11 2" }, "evidence_snippet": ":fq\ufffd\ufffd\ufffd)\ufffd\ufffdJ\ufffdu\ufffd\ufffd\ufffdV\ufffdj\ufffd\ufffd\ufffd\u0730\ufffdH\/ t9)\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffdB\ufffd\/wN\u071f\ufffd\ufffd\u0085r\ufffdH\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdk", "attack_vector": "x11-2 \u00b7 via X11 2:6002 \u00b7 (sonde \/ probe)", "target_port_label": "6002 \u00b7 X11 2", "emulator_service": "x11-2", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab x11-2 \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab x11-2 \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "x11-2", "service_label_fr": "X11 2", "dst_port": 6002, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-x11-2", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\u0013\u0001\u0000\u0006\u000f\u0003\u0003\n\r\f:\u0002f\u0013q\ufffd\ufffd\ufffd)\ufffd\ufffdJ\ufffdu\ufffd\u000b\ufffd\ufffdV\ufffdj\ufffd\ufffd\ufffd\u0730\ufffdH\/ t9)\ufffd\ufffd\ufffd\ufffd\ufffdW\u0001\ufffd\ufffd\u0006\ufffd\ufffd\ufffd!\ufffdB\ufffd\/wN\u071f\ufffd\u001c\ufffd\u0085r\ufffd\u0000H\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\u0000\ufffd\u0000\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0000k", "port": 6002, "service": "x11-2", "service_label_fr": "X11 2" }, "attack_vector": "x11-2 \u00b7 via X11 2:6002 \u00b7 (sonde \/ probe)", "evidence_snippet": ":fq\ufffd\ufffd\ufffd)\ufffd\ufffdJ\ufffdu\ufffd\ufffd\ufffdV\ufffdj\ufffd\ufffd\ufffd\u0730\ufffdH\/ t9)\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffdB\ufffd\/wN\u071f\ufffd\ufffd\u0085r\ufffdH\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdk", "target_port_label": "6002 \u00b7 X11 2", "emulator_service": "x11-2", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "x11_2", "service_banner": "honeypot-x11-2", "service_os": "linux", "dst_port": "6002" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ], "asn_dc_heuristic": true }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

44.220.185.41

Profil de menace

Pourquoi listée

Comparaison ASN / FAI

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence