Détails IP 45.115.26.44

Pourquoi listée

Sonde HTTP (tag nosqli-3) · confiance 68%

Confiance 68 % — Score WAF 32 · 1 tag(s) WAF

Comparaison ASN / FAI

ASN 199457 · 45.115.26.0/24 · APNIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 6 événements sur la période pour cette IP.

45.115.26.86 Sonde port 13/10/2026 03:08 UTC
45.115.26.75 Sonde port 13/10/2026 03:07 UTC
45.115.26.110 Sonde port 13/10/2026 03:07 UTC
45.115.26.115 Sonde VNC (5902/TCP) 13/10/2026 03:05 UTC
45.115.26.95 Sonde VNC 13/10/2026 03:00 UTC
45.115.26.103 Sonde port 13/10/2026 02:59 UTC
45.115.26.113 Sonde VNC 13/10/2026 02:59 UTC
45.115.26.114 Sonde port 13/10/2026 02:58 UTC

IPs apparentées

Même FAI SolidCore Hosting LTD — corrélation indicative.

45.115.26.86 Sonde port
45.115.26.75 Sonde port
45.115.26.110 Sonde port
45.115.26.115 Sonde VNC (5902/TCP)
45.115.26.95 Sonde VNC

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 4 SAP ICM TCP 1

HTTP

4

SAP ICM

1

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

6 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
13/10/2026 03:43:17 UTC	TCP	4750 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:4750 · (sonde / probe) · → /internal_forms_authentication/	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /internal_forms_authentication/ UA Mozilla/5.0 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 Cible HTTP GET /internal_forms_authentication/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4750 Chemin / cible /internal_forms_authentication/ Service HTTP Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 68% Confiance classification 68% Risque capteur Moyen · 40 Confiance : Confiance 68 % — Score WAF 32 · 1 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /internal_forms_authentication/ HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF nosqli-3 Payload (extrait) GET /internal_forms_authentication/ HTTP/1.0 Host: 62.3.50.33 User-Agent: Mozilla/5.0 Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "7206de77dbad044fae582805ae41d19e2c78aa91", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 91, "payload_entropy": 4.977482761449452, "port_category": "registered", "org": "SolidCore Hosting LTD", "service": "http", "app_proto": "http", "asn": 199457, "country": "HK", "dst_port": 4750, "risk_waf": 32, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 40, "protocol": 25, "novelty": 15 }, "risk_score": 40, "tag_count": 1, "anomaly_count": 0, "campaign_key": "a5fd1d4890dead99737a095ba7274a82c8da88ed", "event_fingerprint": "baa119caf1bb5a10dd04c8005a6b5ba81c85da7d", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "HK", "asn": 199457, "org": "SolidCore Hosting LTD", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "b450e9db5e6372eb9255374d58bc9492", "path_pattern_hash": "d1e0668aaa0e3c745831188ab97504f8" }, "service_name": "http", "target_context": { "dst_port": 4750, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET \/internal_forms_authentication\/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0\r\n\r\n", "method": "GET", "path": "\/internal_forms_authentication\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/internal_forms_authentication\/ HTTP\/1.1", "request_sample": "GET \/internal_forms_authentication\/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0\r\n\r\n", "payload_snippet": "GET \/internal_forms_authentication\/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "evidence": { "method": "GET", "path": "\/internal_forms_authentication\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/internal_forms_authentication\/ HTTP\/1.1", "request_sample": "GET \/internal_forms_authentication\/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0\r\n\r\n", "payload_snippet": "GET \/internal_forms_authentication\/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%" }, "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%", "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 40, "protocol": 25, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.68, "classification_confidence": 0.68, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "086d0599630542f2a57488b1dc7e05e39a06200b", "protocol_details": { "http_method": "GET", "http_path": "\/internal_forms_authentication\/", "request_line": "GET \/internal_forms_authentication\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 4750, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/internal_forms_authentication\/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:4750 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/internal_forms_authentication\/", "target_port_label": "4750 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 68 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%", "classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 68, "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 40, "protocol": 25, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 4750, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/internal_forms_authentication\/", "request_line": "GET \/internal_forms_authentication\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 4750, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:4750 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/internal_forms_authentication\/", "evidence_snippet": "GET \/internal_forms_authentication\/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "target_port_label": "4750 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 68 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "4750" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 84 }
13/10/2026 03:43:14 UTC	TCP	4750 · HTTP	http	Sonde HTTP http · via HTTP:4750 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA Mozilla/5.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4750 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 58% Confiance classification 58% Risque capteur Faible · 35 Confiance : Confiance 58 % — Score WAF 20 · 1 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.0 Host: 62.3.50.33 User-Agent: Mozilla/5.0 Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 61, "payload_entropy": 4.772881755872872, "port_category": "registered", "org": "SolidCore Hosting LTD", "service": "http", "app_proto": "http", "asn": 199457, "country": "HK", "dst_port": 4750, "risk_waf": 20, "risk_classification": 8, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 20, "classification": 8, "behavior": 0, "geo": 40, "protocol": 25, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "e1c50411dfbac04a912673511b7f4048ff42ffd7", "event_fingerprint": "4318741642fc02909d044c4ec771d859e59949e8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "HK", "asn": 199457, "org": "SolidCore Hosting LTD", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "5f3cc029eb8d849c96540b6a30d6a0a2", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "service_name": "http", "target_context": { "dst_port": 4750, "service": "http", "service_name": "http", "risk_score": 35 }, "payload_preview": "GET \/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0\r\n\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%" }, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%", "confidence_breakdown": { "waf": 20, "classification": 8, "behavior": 0, "geo": 40, "protocol": 25, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "confidence": 0.58, "classification_confidence": 0.58, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "46f0281b222302d13d189b438ac8a75e308695fe", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 4750, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "attack_vector": "http \u00b7 via HTTP:4750 \u00b7 (sonde \/ probe)", "target_port_label": "4750 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 20, "classification": 8, "behavior": 0, "geo": 40, "protocol": 25, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 4750, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 4750, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http \u00b7 via HTTP:4750 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "target_port_label": "4750 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "4750" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path" ], "asn_dc_heuristic": true }
13/10/2026 01:28:52 UTC	TCP	4244 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:4244 · (sonde / probe) · → /internal_forms_authentication/	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /internal_forms_authentication/ UA Mozilla/5.0 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 Cible HTTP GET /internal_forms_authentication/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4244 Chemin / cible /internal_forms_authentication/ Service HTTP Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 68% Confiance classification 68% Risque capteur Moyen · 40 Confiance : Confiance 68 % — Score WAF 32 · 1 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /internal_forms_authentication/ HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF nosqli-3 Payload (extrait) GET /internal_forms_authentication/ HTTP/1.0 Host: 62.3.50.33 User-Agent: Mozilla/5.0 Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "7206de77dbad044fae582805ae41d19e2c78aa91", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 91, "payload_entropy": 4.977482761449452, "port_category": "registered", "org": "SolidCore Hosting LTD", "service": "http", "app_proto": "http", "asn": 199457, "country": "HK", "dst_port": 4244, "risk_waf": 32, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 40, "protocol": 25, "novelty": 15 }, "risk_score": 40, "tag_count": 1, "anomaly_count": 0, "campaign_key": "f96f0fd7a5182f54584b35e1ed8b24ea79236e37", "event_fingerprint": "81d8ecbf865868697d4b4a6538c2f198d35b18dd", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "HK", "asn": 199457, "org": "SolidCore Hosting LTD", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "b450e9db5e6372eb9255374d58bc9492", "path_pattern_hash": "d1e0668aaa0e3c745831188ab97504f8" }, "service_name": "http", "target_context": { "dst_port": 4244, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET \/internal_forms_authentication\/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0\r\n\r\n", "method": "GET", "path": "\/internal_forms_authentication\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/internal_forms_authentication\/ HTTP\/1.1", "request_sample": "GET \/internal_forms_authentication\/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0\r\n\r\n", "payload_snippet": "GET \/internal_forms_authentication\/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "evidence": { "method": "GET", "path": "\/internal_forms_authentication\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/internal_forms_authentication\/ HTTP\/1.1", "request_sample": "GET \/internal_forms_authentication\/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0\r\n\r\n", "payload_snippet": "GET \/internal_forms_authentication\/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%" }, "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%", "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 40, "protocol": 25, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.68, "classification_confidence": 0.68, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4513ee1099ac170b1fd66abbf4f4f94dc3abe857", "protocol_details": { "http_method": "GET", "http_path": "\/internal_forms_authentication\/", "request_line": "GET \/internal_forms_authentication\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 4244, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/internal_forms_authentication\/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:4244 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/internal_forms_authentication\/", "target_port_label": "4244 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 68 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%", "classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 68, "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 40, "protocol": 25, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 4244, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/internal_forms_authentication\/", "request_line": "GET \/internal_forms_authentication\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 4244, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:4244 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/internal_forms_authentication\/", "evidence_snippet": "GET \/internal_forms_authentication\/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "target_port_label": "4244 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 68 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "4244" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3" ], "asn_dc_heuristic": true }
13/10/2026 01:28:49 UTC	TCP	4244 · HTTP	http	Sonde HTTP http · via HTTP:4244 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA Mozilla/5.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4244 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 58% Confiance classification 58% Risque capteur Faible · 35 Confiance : Confiance 58 % — Score WAF 20 · 1 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.0 Host: 62.3.50.33 User-Agent: Mozilla/5.0 Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 61, "payload_entropy": 4.772881755872872, "port_category": "registered", "org": "SolidCore Hosting LTD", "service": "http", "app_proto": "http", "asn": 199457, "country": "HK", "dst_port": 4244, "risk_waf": 20, "risk_classification": 8, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 20, "classification": 8, "behavior": 0, "geo": 40, "protocol": 25, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "ce5782a3687cb967fc9d2702e32b6c4c35b65df7", "event_fingerprint": "633fae7bda81f882a3dffe35c53d57c80c40b25e", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "HK", "asn": 199457, "org": "SolidCore Hosting LTD", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "5f3cc029eb8d849c96540b6a30d6a0a2", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "service_name": "http", "target_context": { "dst_port": 4244, "service": "http", "service_name": "http", "risk_score": 35 }, "payload_preview": "GET \/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0\r\n\r\n", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%" }, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%", "confidence_breakdown": { "waf": 20, "classification": 8, "behavior": 0, "geo": 40, "protocol": 25, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "confidence": 0.58, "classification_confidence": 0.58, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d7dde9b0adcc0993e24a2d5eb5bf2c2597ed0055", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 4244, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "attack_vector": "http \u00b7 via HTTP:4244 \u00b7 (sonde \/ probe)", "target_port_label": "4244 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 20, "classification": 8, "behavior": 0, "geo": 40, "protocol": 25, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 4244, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 4244, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http \u00b7 via HTTP:4244 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "target_port_label": "4244 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "4244" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path" ], "asn_dc_heuristic": true }
12/10/2026 10:00:03 UTC	TCP	8000 · SAP ICM	sap-icm	Sonde SAP ICM HTTP Sonde SAP ICM / WebDynpro · via SAP ICM:8000 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_sap_web_probe sap_icm_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload GET /api/v2/heartbeat HTTP/1.0 Host: 62.3.50.33 User-Agent: Mozilla/5.0 Pourquoi cette classification : Type « sap_web_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api/v2/heartbeat HTTP/1.0 Host: 62.3.50.33 User-Agent: Mozilla/5.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c", "emulator_response_len": 141, "bytes_in": 77, "payload_entropy": 4.922839223092773, "port_category": "registered", "org": "SolidCore Hosting LTD", "service": "sap-icm", "app_proto": "sap-icm", "asn": 199457, "country": "HK", "dst_port": 8000, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 48, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 48, "novelty": 25 }, "risk_score": 34, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4d3bfae803bd07fc62331c16ac15c5323341684", "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a", "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 48, "novelty": 25, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "HK", "asn": 199457, "org": "SolidCore Hosting LTD", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7812b80d7071fa856614aa93256f11bf", "path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 34 }, "payload_preview": "GET \/api\/v2\/heartbeat HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0\r\n\r\n", "request_sample": "GET \/api\/v2\/heartbeat HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0\r\n\r\n", "payload_snippet": "GET \/api\/v2\/heartbeat HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "evidence": { "request_sample": "GET \/api\/v2\/heartbeat HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0\r\n\r\n", "payload_snippet": "GET \/api\/v2\/heartbeat HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "sap_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ec4660b21c79002f7ca7da6a5a42aef863066af7", "protocol_details": { "payload_preview": "GET \/api\/v2\/heartbeat HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "GET \/api\/v2\/heartbeat HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 48, "novelty": 25, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/api\/v2\/heartbeat HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api\/v2\/heartbeat HTTP\/1.0\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_sap_web_probe", "sap_icm_emulated", "sap_icm_payload" ], "asn_dc_heuristic": true }
11/10/2026 20:53:00 UTC	TCP	122	—	Sonde port 122 Sonde port · port 122 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 122 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "well_known", "org": "SolidCore Hosting LTD", "service": null, "app_proto": null, "asn": 199457, "country": "HK", "dst_port": 122, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "ec603ff063f5adb4ab08fc8ae52994603a8d6b43", "event_fingerprint": "b8c6e655505525014a282f194e79c05fbfd931c4", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "HK", "asn": 199457, "org": "SolidCore Hosting LTD", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 122, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a70e8bfdb511f280fd88d38f907899d1c81602c0", "protocol_details": { "port": 122 }, "attack_vector": "Sonde port \u00b7 port 122 \u00b7 (sonde \/ probe)", "target_port_label": "122", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 122, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 122 }, "attack_vector": "Sonde port \u00b7 port 122 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "122", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "122" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

45.115.26.44

Synthèse

Pourquoi listée

Comparaison ASN / FAI

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence