Détails IP 44.220.188.64

Pourquoi listée

Type « kafka-jmx » (signaux protocolaires) · confiance 0%

Confiance faible (0 %) — classification prudente

Comparaison ASN / FAI

ASN 14618 · 44.192.0.0/11 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 5 événements sur la période pour cette IP.

18.116.101.220 Sonde port 12/10/2026 18:36 UTC
18.97.26.7 Sonde SSH 12/10/2026 18:29 UTC
100.59.196.196 Sonde PostgreSQL 12/10/2026 18:17 UTC
100.53.130.45 Tentative d'exploit 12/10/2026 18:17 UTC
54.158.70.149 Sonde PostgreSQL 12/10/2026 18:17 UTC
3.83.162.99 Sonde PostgreSQL 12/10/2026 18:17 UTC
54.145.20.113 Sonde PostgreSQL 12/10/2026 18:17 UTC
44.201.116.222 Sonde PostgreSQL 12/10/2026 18:17 UTC

IPs apparentées

Même FAI Amazon.com, Inc. — corrélation indicative.

18.116.101.220 Sonde port
18.97.26.7 Sonde SSH
100.59.196.196 Sonde PostgreSQL
100.53.130.45 Tentative d'exploit
54.158.70.149 Sonde PostgreSQL

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

5 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
12/10/2026 17:01:52 UTC	TCP	9091 · KAFKA JMX	kafka-jmx	Sonde Kafka JMX kafka-jmx · via KAFKA JMX:9091 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KAFKA-JMX WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9091 Chemin / cible — Service KAFKA JMX Pourquoi cette classification : Type « kafka-jmx » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206b61666b615f6a6d7820726561647920706f72743d393039310d0a", "emulator_response_len": 40, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Amazon.com, Inc.", "service": "kafka-jmx", "app_proto": "kafka-jmx", "asn": 14618, "country": "US", "dst_port": 9091, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "b43db552447d9da091993685e2643068f24372d9", "event_fingerprint": "c58ab12dc1fefd8340494c3b1522d2ff34dfdb9e", "classification_reason": "Type \u00ab kafka-jmx \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "kafka-jmx", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14618, "org": "Amazon.com, Inc.", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "b559ec958a47d0fa45debbf0f8ddb3e2" }, "target_context": { "dst_port": 9091, "service": "kafka-jmx", "service_name": "kafka-jmx", "risk_score": 0 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ab3ae93158a0b3f72e0853d8cf3e609657478ed6", "protocol_details": { "port": 9091, "service": "kafka-jmx", "service_label_fr": "KAFKA JMX" }, "attack_vector": "kafka-jmx \u00b7 via KAFKA JMX:9091 \u00b7 (sonde \/ probe)", "target_port_label": "9091 \u00b7 KAFKA JMX", "emulator_service": "kafka-jmx", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka-jmx \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab kafka-jmx \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "kafka-jmx", "service_label_fr": "KAFKA JMX", "dst_port": 9091, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kafka-jmx", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 9091, "service": "kafka-jmx", "service_label_fr": "KAFKA JMX" }, "attack_vector": "kafka-jmx \u00b7 via KAFKA JMX:9091 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "9091 \u00b7 KAFKA JMX", "emulator_service": "kafka-jmx", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kafka_jmx", "service_banner": "honeypot-kafka-jmx", "service_os": "linux", "dst_port": "9091" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
12/10/2026 17:01:45 UTC	TCP	9091 · KAFKA JMX	kafka-jmx	Sonde Kafka JMX kafka-jmx · via KAFKA JMX:9091 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KAFKA-JMX WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9091 Chemin / cible — Service KAFKA JMX Pourquoi cette classification : Type « kafka-jmx » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206b61666b615f6a6d7820726561647920706f72743d393039310d0a", "emulator_response_len": 40, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Amazon.com, Inc.", "service": "kafka-jmx", "app_proto": "kafka-jmx", "asn": 14618, "country": "US", "dst_port": 9091, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.3, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "b43db552447d9da091993685e2643068f24372d9", "event_fingerprint": "c58ab12dc1fefd8340494c3b1522d2ff34dfdb9e", "classification_reason": "Type \u00ab kafka-jmx \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "kafka-jmx", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14618, "org": "Amazon.com, Inc.", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "b559ec958a47d0fa45debbf0f8ddb3e2" }, "target_context": { "dst_port": 9091, "service": "kafka-jmx", "service_name": "kafka-jmx", "risk_score": 0 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ab3ae93158a0b3f72e0853d8cf3e609657478ed6", "protocol_details": { "port": 9091, "service": "kafka-jmx", "service_label_fr": "KAFKA JMX" }, "attack_vector": "kafka-jmx \u00b7 via KAFKA JMX:9091 \u00b7 (sonde \/ probe)", "target_port_label": "9091 \u00b7 KAFKA JMX", "emulator_service": "kafka-jmx", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka-jmx \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab kafka-jmx \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "kafka-jmx", "service_label_fr": "KAFKA JMX", "dst_port": 9091, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kafka-jmx", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 9091, "service": "kafka-jmx", "service_label_fr": "KAFKA JMX" }, "attack_vector": "kafka-jmx \u00b7 via KAFKA JMX:9091 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "9091 \u00b7 KAFKA JMX", "emulator_service": "kafka-jmx", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kafka_jmx", "service_banner": "honeypot-kafka-jmx", "service_os": "linux", "dst_port": "9091" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
12/10/2026 17:01:45 UTC	TCP	9091 · KAFKA JMX	kafka-jmx	Sonde Kafka JMX kafka-jmx · via KAFKA JMX:9091 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KAFKA-JMX WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9091 Chemin / cible — Service KAFKA JMX Payload "��6��/k�3S�p��s0X��P�Aݱm&eM ��ٮ��i��ɦ�wb��B5�^�f��A�H�,�0�+�/̨̩��̪��$�(�#�'� �� k Pourquoi cette classification : Type « kafka-jmx » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) "��6��/k�3S�p��s0X��P�Aݱm&eM ��ٮ��i��ɦ�wb��B5�^�f��A�H�,�0�+�/̨̩��̪��$�(�#�'� �� k Requête brute (extrait) "��6��/k�3S�p��s0X��P�Aݱm&eM ��ٮ��i��ɦ�wb��B5�^�f��A�H�,�0�+�/̨̩��̪��$�(�#�'� �� kg93��=<5/~� � http/1.11 64 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206b61666b615f6a6d7820726561647920706f72743d393039310d0a", "emulator_response_len": 40, "bytes_in": 1560, "payload_entropy": 7.717170261408774, "port_category": "registered", "org": "Amazon.com, Inc.", "service": "kafka-jmx", "app_proto": "kafka-jmx", "asn": 14618, "country": "US", "dst_port": 9091, "risk_waf": 8, "risk_classification": 24, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "4f39d54b3867ce6827fbc2a6bad12f3e00fca027", "event_fingerprint": "c58ab12dc1fefd8340494c3b1522d2ff34dfdb9e", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab kafka-jmx \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 35 }, "service_name": "kafka-jmx", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14618, "org": "Amazon.com, Inc.", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "38f95e42f1035e6ddd6ae458d0781edc", "path_pattern_hash": "b559ec958a47d0fa45debbf0f8ddb3e2" }, "target_context": { "dst_port": 9091, "service": "kafka-jmx", "service_name": "kafka-jmx", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0006\u0013\u0001\u0000\u0006\u000f\u0003\u0003\"\ufffd\ufffd\u00176\ufffd\ufffd\/k\ufffd3S\ufffdp\ufffd\ufffd\ufffd\ufffds0X\ufffd\ufffdP\ufffdA\u0771m&eM \u0011\ufffd\ufffd\u066e\ufffd\ufffdi\ufffd\ufffd\ufffd\u001b\u0266\ufffdwb\ufffd\ufffdB5\ufffd^\ufffdf\ufffd\ufffd\ufffdA\u0004\ufffd\u0000H\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\u0000\ufffd\u0000\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0000k", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\u0013\u0001\u0000\u0006\u000f\u0003\u0003\"\ufffd\ufffd\u00176\ufffd\ufffd\/k\ufffd3S\ufffdp\ufffd\ufffd\ufffd\ufffds0X\ufffd\ufffdP\ufffdA\u0771m&eM \u0011\ufffd\ufffd\u066e\ufffd\ufffdi\ufffd\ufffd\ufffd\u001b\u0266\ufffdwb\ufffd\ufffdB5\ufffd^\ufffdf\ufffd\ufffd\ufffdA\u0004\ufffd\u0000H\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\u0000\ufffd\u0000\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0000k\u0000g\u00009\u00003\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u0000<\u00005\u0000\/\u0001\u0000\u0005~\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u00006\u00004\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006", "payload_snippet": "\u0016\u0003\u0001\u0006\u0013\u0001\u0000\u0006\u000f\u0003\u0003\"\ufffd\ufffd\u00176\ufffd\ufffd\/k\ufffd3S\ufffdp\ufffd\ufffd\ufffd\ufffds0X\ufffd\ufffdP\ufffdA\u0771m&eM \u0011\ufffd\ufffd\u066e\ufffd\ufffdi\ufffd\ufffd\ufffd\u001b\u0266\ufffdwb\ufffd\ufffdB5\ufffd^\ufffdf\ufffd\ufffd\ufffdA\u0004\ufffd\u0000H\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\u0000\ufffd\u0000\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0000k", "classification_reason": "Type \u00ab kafka-jmx \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b3676e8a595e315ce7d892016b585f946e460fbc", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\u0013\u0001\u0000\u0006\u000f\u0003\u0003\"\ufffd\ufffd\u00176\ufffd\ufffd\/k\ufffd3S\ufffdp\ufffd\ufffd\ufffd\ufffds0X\ufffd\ufffdP\ufffdA\u0771m&eM \u0011\ufffd\ufffd\u066e\ufffd\ufffdi\ufffd\ufffd\ufffd\u001b\u0266\ufffdwb\ufffd\ufffdB5\ufffd^\ufffdf\ufffd\ufffd\ufffdA\u0004\ufffd\u0000H\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\u0000\ufffd\u0000\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0000k", "port": 9091, "service": "kafka-jmx", "service_label_fr": "KAFKA JMX" }, "evidence_snippet": "\"\ufffd\ufffd6\ufffd\ufffd\/k\ufffd3S\ufffdp\ufffd\ufffd\ufffd\ufffds0X\ufffd\ufffdP\ufffdA\u0771m&eM \ufffd\ufffd\u066e\ufffd\ufffdi\ufffd\ufffd\ufffd\u0266\ufffdwb\ufffd\ufffdB5\ufffd^\ufffdf\ufffd\ufffd\ufffdA\ufffdH\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdk", "attack_vector": "kafka-jmx \u00b7 via KAFKA JMX:9091 \u00b7 (sonde \/ probe)", "target_port_label": "9091 \u00b7 KAFKA JMX", "emulator_service": "kafka-jmx", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka-jmx \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab kafka-jmx \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "kafka-jmx", "service_label_fr": "KAFKA JMX", "dst_port": 9091, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kafka-jmx", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\u0013\u0001\u0000\u0006\u000f\u0003\u0003\"\ufffd\ufffd\u00176\ufffd\ufffd\/k\ufffd3S\ufffdp\ufffd\ufffd\ufffd\ufffds0X\ufffd\ufffdP\ufffdA\u0771m&eM \u0011\ufffd\ufffd\u066e\ufffd\ufffdi\ufffd\ufffd\ufffd\u001b\u0266\ufffdwb\ufffd\ufffdB5\ufffd^\ufffdf\ufffd\ufffd\ufffdA\u0004\ufffd\u0000H\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\u0000\ufffd\u0000\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0000k", "port": 9091, "service": "kafka-jmx", "service_label_fr": "KAFKA JMX" }, "attack_vector": "kafka-jmx \u00b7 via KAFKA JMX:9091 \u00b7 (sonde \/ probe)", "evidence_snippet": "\"\ufffd\ufffd6\ufffd\ufffd\/k\ufffd3S\ufffdp\ufffd\ufffd\ufffd\ufffds0X\ufffd\ufffdP\ufffdA\u0771m&eM \ufffd\ufffd\u066e\ufffd\ufffdi\ufffd\ufffd\ufffd\u0266\ufffdwb\ufffd\ufffdB5\ufffd^\ufffdf\ufffd\ufffd\ufffdA\ufffdH\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd\ufffd\u032a\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\n\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdk", "target_port_label": "9091 \u00b7 KAFKA JMX", "emulator_service": "kafka-jmx", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kafka_jmx", "service_banner": "honeypot-kafka-jmx", "service_os": "linux", "dst_port": "9091" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ], "asn_dc_heuristic": true }
12/10/2026 17:01:45 UTC	TCP	9091 · KAFKA JMX	kafka-jmx	SSRF interne ssrf internal · via KAFKA JMX:9091 · (tentative d'exploit)	Élevée	Moyen · 51
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur KAFKA-JMX WAF — Recommandation Investiguer Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9091 Chemin / cible — Service KAFKA JMX Payload GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3061.104 Sa Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54% Confiance classification 54% Risque capteur Moyen · 51 Confiance : Confiance 54 % — Motif catalogue confirmé Protocole émulé 1 Signaux CRS-920350 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3061.104 Sa Requête brute (extrait) GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3061.104 Safari/537.32 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Host: localhost Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206b61666b615f6a6d7820726561647920706f72743d393039310d0a", "emulator_response_len": 40, "bytes_in": 229, "payload_entropy": 5.380700802882379, "port_category": "registered", "org": "Amazon.com, Inc.", "service": "kafka-jmx", "app_proto": "kafka-jmx", "asn": 14618, "country": "US", "dst_port": 9091, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15 }, "risk_score": 51, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a8c4adfa32f323ec2546809ab0e547456322600b", "event_fingerprint": "971ef2e8331e408f981a3d06d9f2f0499dd5d0ba", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "confidence": 0.54, "classification_confidence": 0.54, "precision_score": 64, "precision_signals": [ "CRS-920350" ], "kb_rule_ids": [ "CRS-920350" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15, "risk_score": 51 }, "named_classification_skipped": false, "classification_parent": "ssrf_attack", "service_name": "kafka-jmx", "risk_confidence_factor": 54, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14618, "org": "Amazon.com, Inc.", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3959586f5df951d6e3c4be0b438291b7", "path_pattern_hash": "2926fa5ba65a298fe7630f4e1d1dd6ea" }, "target_context": { "dst_port": 9091, "service": "kafka-jmx", "service_name": "kafka-jmx", "risk_score": 51 }, "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/54.0.3061.104 Sa", "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/54.0.3061.104 Safari\/537.32\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nHost: localhost\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/54.0.3061.104 Sa", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/54.0.3061.104 Safari\/537.32\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\nHost: localhost\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/54.0.3061.104 Sa", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9570b711b7c91e48e7494b53ee1215ee95b4b4b2", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/54.0.3061.104 Sa", "port": 9091, "service": "kafka-jmx", "service_label_fr": "KAFKA JMX" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/54.0.3061.104 Sa", "attack_vector": "ssrf internal \u00b7 via KAFKA JMX:9091 \u00b7 (tentative d'exploit)", "target_port_label": "9091 \u00b7 KAFKA JMX", "emulator_service": "kafka-jmx", "confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via KAFKA JMX", "confidence_pct": 54, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15, "risk_score": 51 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 51, "risk_label": "Moyen", "service_name": "kafka-jmx", "service_label_fr": "KAFKA JMX", "dst_port": 9091, "protocol_emulated": true, "tags_summary": [ "CRS-920350" ], "tags_summary_labels_fr": [ "CRS-920350" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kafka-jmx", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/54.0.3061.104 Sa", "port": 9091, "service": "kafka-jmx", "service_label_fr": "KAFKA JMX" }, "attack_vector": "ssrf internal \u00b7 via KAFKA JMX:9091 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/54.0.3061.104 Sa", "target_port_label": "9091 \u00b7 KAFKA JMX", "emulator_service": "kafka-jmx", "confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kafka_jmx", "service_banner": "honeypot-kafka-jmx", "service_os": "linux", "dst_port": "9091" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ], "asn_dc_heuristic": true }
12/10/2026 17:01:44 UTC	TCP	9091 · KAFKA JMX	kafka-jmx	Botnet Mozi mozi pattern · via KAFKA JMX:9091 · (commande & contrôle)	Élevée	Moyen · 41
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur KAFKA-JMX WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9091 Chemin / cible — Service KAFKA JMX Payload GET / HTTP/1.1 Host: 62.3.50.33:9091 User-Agent: Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Moyen · 41 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE TA0011 User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9091 User-Agent: Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9091 User-Agent: Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3061.104 Safari/537.32 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74206b61666b615f6a6d7820726561647920706f72743d393039310d0a", "emulator_response_len": 40, "bytes_in": 235, "payload_entropy": 5.399603797485171, "port_category": "registered", "org": "Amazon.com, Inc.", "service": "kafka-jmx", "app_proto": "kafka-jmx", "asn": 14618, "country": "US", "dst_port": 9091, "risk_waf": 8, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15 }, "risk_score": 41, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a8c4adfa32f323ec2546809ab0e547456322600b", "event_fingerprint": "971ef2e8331e408f981a3d06d9f2f0499dd5d0ba", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15, "risk_score": 41 }, "named_classification_skipped": false, "service_name": "kafka-jmx", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14618, "org": "Amazon.com, Inc.", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2397214cda66f0541bfeae5af00d0f04", "path_pattern_hash": "762d384fab941f6d0c2239f19994f30e" }, "target_context": { "dst_port": 9091, "service": "kafka-jmx", "service_name": "kafka-jmx", "risk_score": 41 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) ", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/54.0.3061.104 Safari\/537.32\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko)", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko) Chrome\/54.0.3061.104 Safari\/537.32\r\nAccept-Encoding: gzip, deflate\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko)", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c5602e9dd302cf794ba0c3d276d8c7899a11da73", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko)", "port": 9091, "service": "kafka-jmx", "service_label_fr": "KAFKA JMX" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko)", "attack_vector": "mozi pattern \u00b7 via KAFKA JMX:9091 \u00b7 (commande & contr\u00f4le)", "target_port_label": "9091 \u00b7 KAFKA JMX", "emulator_service": "kafka-jmx", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0011 \u2014 via KAFKA JMX", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15, "risk_score": 41 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 41, "risk_label": "Moyen", "service_name": "kafka-jmx", "service_label_fr": "KAFKA JMX", "dst_port": 9091, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kafka-jmx", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko)", "port": 9091, "service": "kafka-jmx", "service_label_fr": "KAFKA JMX" }, "attack_vector": "mozi pattern \u00b7 via KAFKA JMX:9091 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9091\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2;en-US) AppleWebKit\/537.32.36 (KHTML, live Gecko)", "target_port_label": "9091 \u00b7 KAFKA JMX", "emulator_service": "kafka-jmx", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kafka_jmx", "service_banner": "honeypot-kafka-jmx", "service_os": "linux", "dst_port": "9091" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ], "asn_dc_heuristic": true }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

44.220.188.64

Synthèse

Pourquoi listée

Comparaison ASN / FAI

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence