Fiche IP

États-Unis

45.131.155.103

Activité suspecte — risque 55/100 (Moyen) — MITRE TA0001 — confiance 50 % — via HTTP

FAI Detai Prosperous Technologies Limited Première vue 20/10/2026 02:41 UTC Dernière vue 01/11/2026 22:55 UTC Risque Moyen

Période 2026-08-03 → 2026-11-01

Moyen 58/100

24h 7j 30j 90j

Synthèse

Score de risque max. 58/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 20/10/2026 02:41 UTC

Dernière observation 01/11/2026 22:55 UTC

Événements (période) 129

Décision conseillée Investiguer Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal TA0001 129 occurrences

Pourquoi listée

Règle WAF « ssrf-3 » · confiance 50%

Confiance 50 % — Score WAF 84 · 3 tag(s) WAF

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

58/100 Confiance 50 % 129 événements TA0001

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 45.131.155.103
Décision : Investiguer
Score max : 58/100 (Moyen)
Confiance : 50 %
Période : 2026-08-03 → 2026-11-01 · 129 événements
Motif : Règle WAF « ssrf-3 » · confiance 50%
MITRE : TA0001
FAI : Detai Prosperous Technologies Limited · États-Unis

Comparaison ASN / FAI

ASN 212512 · 45.131.155.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 129 événements sur la période pour cette IP.

45.131.155.102 SSRF 01/11/2026 22:58 UTC
45.131.155.100 SSRF 01/11/2026 20:26 UTC
45.131.155.101 SSRF 01/11/2026 16:07 UTC
45.82.78.103 SSRF interne 29/10/2026 02:05 UTC
45.82.78.104 Sonde OpenVPN 28/10/2026 08:02 UTC
45.82.78.106 Sonde port 22/10/2026 11:02 UTC
45.82.78.105 Sonde port 22/10/2026 08:23 UTC
45.82.78.102 Sonde port 22/10/2026 08:06 UTC

Événements (filtres)

129

Première observation

20/10/2026 02:41 UTC

Dernière observation

01/11/2026 22:55 UTC

Dernière activité (filtres)

01/11/2026 22:55 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Géolocalisation

Origine réseau déclarée

États-Unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Detai Prosperous Technologies Limited 0 Port 9392 SSRF

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

ssrf attack · via HTTP:9392 · (tentative d'exploit) · → /favicon.ico

Détails protocole

Méthode: GET
Chemin: /favicon.ico
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0…

Aperçu payload

GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:9392 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36

Port / service

9392 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 50 % — 3 tag(s) WAF

Technique MITRE

TA0001

Persona capteur

mail.sensor-1.internal

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

Upstream Waf Score

Confiance

50% Confiance modérée — signal unique

Famille de menace

ssrf_probe

MITRE ATT&CK — tactiques observées

Accès initial Exécution

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

129 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

129 événement(s) — page 2/6

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
30/10/2026 19:25:34 UTC	TCP	2121 · HTTP	http	SSRF ssrf attack · via HTTP:2121 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2121 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 52 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2121 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2121 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/a Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"fe952eeb0a64ae28bec110247298a77b6bf2a83d","http_host_hash":"0d8ced431957ed543d38612082407234ae7cda34","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"4dfb11965b366448dad3c1c019dae997e801c2d0","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":699,"payload_entropy":5.545645041078081,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":2121,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.1,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":52,"tag_count":3,"anomaly_count":0,"campaign_key":"5529addae4b349dde2e4ac5d54e6d9c681540962","event_fingerprint":"1fd2195e7c68f3e29a52bf4c9676c9013c4a24b2","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":52},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter…
30/10/2026 16:28:17 UTC	TCP	4242 · HTTP	http	SSRF ssrf attack · via HTTP:4242 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 54
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4242 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 54 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:4242 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:4242 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,im Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"734b6ead759b479a4292aa92494c1177234bdcc9","http_host_hash":"3675e10fa4b9e3779f86217fd35b1d33710de914","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"e8cd694a5f2a840fb1cb99c3740066359a70b6ad","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":691,"payload_entropy":5.541325117468737,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":4242,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.2,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":54,"tag_count":3,"anomaly_count":0,"campaign_key":"4346342d5d82518f7095748a351411b665ddefa8","event_fingerprint":"5f41dfcf69bc6d5fad62c6c63db0526f8568db94","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":54},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter…
30/10/2026 16:04:51 UTC	TCP	6792 · HTTP	http	SSRF ssrf attack · via HTTP:6792 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 50
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6792 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 50 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:6792 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:6792 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,im Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"0ee6da41ec05a537578512680117eb768569b88f","http_host_hash":"4a2a99c72f2565a8d57162f354439e145ff20258","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"9c53213aebcb0ea342cad31d4bf11b07774ae4bb","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":687,"payload_entropy":5.518274912809208,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":6792,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.5,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":50,"tag_count":3,"anomaly_count":0,"campaign_key":"0d389d3262fbf92059acd99a1f3314ac744ac93e","event_fingerprint":"caabaaae4076b7a0d4feba0be92a801eb1ddbd9e","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":50},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter…
30/10/2026 12:40:18 UTC	TCP	9773 · HTTP	http	SSRF ssrf attack · via HTTP:9773 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 51
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9773 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 51 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:9773 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:9773 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,im Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"4d4addfff349730a6322517a521b77cd10894329","http_host_hash":"451b6f4efd39a7a368d8700d887e8057a78615d3","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"eeac86a0f2a6814901680a12294fa1c7e12eba6c","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":687,"payload_entropy":5.50638769730007,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":9773,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":51,"tag_count":3,"anomaly_count":0,"campaign_key":"ca892a4f1c4b6ef8295a653a0e2f1145f6c4effe","event_fingerprint":"da324d0fd4ec86952ceed9bb917a389b963cdde4","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":51},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter"…
30/10/2026 12:18:37 UTC	TCP	2401 · HTTP	http	SSRF ssrf attack · via HTTP:2401 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2401 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 52 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2401 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2401 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"794d54186261fe2bc2736ed06e3d0e320c015c5f","http_host_hash":"453bf29a76f3e411f8b6f9fe287aeac974f2f6f5","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"2f7d52cc41ff2c500c3047d535de49577da44914","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":701,"payload_entropy":5.540820371517523,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":2401,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.3,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":52,"tag_count":3,"anomaly_count":0,"campaign_key":"e5ce92644b62d38e3877d1fdf4fe53df4c12399f","event_fingerprint":"60cd9cca1d5f704294dbdb95de66db9dc1520430","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":52},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter…
30/10/2026 12:12:42 UTC	TCP	2004 · HTTP	http	SSRF ssrf attack · via HTTP:2004 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 53
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2004 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2004 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2004 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,im Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"0ee6da41ec05a537578512680117eb768569b88f","http_host_hash":"69bf520735777e8d911c75ba5d3db4e37c01f68c","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"be6e903f00ca0b27b3ea5b3369ae8118c4552f0f","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":713,"payload_entropy":5.536658723776328,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":2004,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.2,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":53,"tag_count":3,"anomaly_count":0,"campaign_key":"18cc54424b10ae27268307320a0f5281d5f06a17","event_fingerprint":"4a986a8b581567d15e909b9b0976460eea80565a","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":53},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter…
30/10/2026 06:32:32 UTC	TCP	6646 · HTTP	http	SSRF ssrf attack · via HTTP:6646 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6646 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 52 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:6646 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:6646 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,im Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"4d4addfff349730a6322517a521b77cd10894329","http_host_hash":"bb1aec2656288ed4c4f75743dee519c13e31d39a","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"128838c76d7364b8a62fd641698f94a3d11b16ac","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":718,"payload_entropy":5.53286261749953,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":6646,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":52,"tag_count":3,"anomaly_count":0,"campaign_key":"37bd2c8d0f682abae60a0c290ba03320f99457a5","event_fingerprint":"e979c6a428191f5a25f33918595c56b3d6cc3a68","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":52},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter":f…
29/10/2026 20:23:24 UTC	TCP	2271 · HTTP	http	SSRF ssrf attack · via HTTP:2271 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 51
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2271 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 51 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2271 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2271 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/a Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"1c1f86ba252c0c8ebc250acab48718f12d6d1efd","http_host_hash":"d290c99c5a811e514dfde6471fd90c4d1f4109f9","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"a9df77101891b7a3a0dc535aba8fd691dd24d666","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":675,"payload_entropy":5.545743471739009,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":2271,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":51,"tag_count":3,"anomaly_count":0,"campaign_key":"5d5e9960ea78c0f7f4dc15c618a2679fc7ffb3c7","event_fingerprint":"a43785bc3a435ed34c39173fa22734ab3aec196b","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":51},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter…
29/10/2026 18:28:32 UTC	TCP	4006 · HTTP	http	SSRF interne ssrf internal · via HTTP:4006 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 50
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4006 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Type « SSRF interne » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 50 Confiance : Confiance 50 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux CRS-920350 Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:4006 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:4006 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,im Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"4461d179cd985cbaf0fade9ccaad7d3787cc0c6f","http_host_hash":"8e0862bfbf240870df2c8b9ad22d5dbe7660fe0b","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"dc2feb8c6abad09d6c2c13a237e2ec75e52190f4","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":712,"payload_entropy":5.531498266921989,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":4006,"risk_waf":84,"risk_classification":80,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.2,"risk_breakdown":{"waf":84,"classification":80,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":50,"tag_count":3,"anomaly_count":0,"campaign_key":"4a835e93382af3b9a221268fdf7427f5a71b7227","event_fingerprint":"9f3ec509e597192c2da3feeef9328df7d79366f0","classification_reason":"Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":64,"precision_signals":["CRS-920350"],"kb_rule_ids":["CRS-920350"],"confidence_breakdown":{"waf":84,"classification":80,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":50},"named_classification_skipped":false,"classification_parent":"ssrf_attack","service_name":"http","risk_confidence_factor":50,"ci…
29/10/2026 18:27:44 UTC	TCP	2008 · HTTP	http	SSRF ssrf attack · via HTTP:2008 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 54
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2008 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 54 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.7204.97 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2008 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2008 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.7204.97 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,imag Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"ef81cd55fb95aeb5554caa847a70d81b9808c30d","http_host_hash":"7bb635e65ef4fd7bb0862cbc3ad947c961fdd005","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"6adda37d944cd41d192e75bacbaa7d0571fc72de","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":706,"payload_entropy":5.53656981679194,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":2008,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.9,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":54,"tag_count":3,"anomaly_count":0,"campaign_key":"fda8e443d3affc24213371c4f6d1b0ce873fb274","event_fingerprint":"4635ee59f8175281581d2063d7ce573e348b0c05","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":54},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter"…
29/10/2026 18:15:54 UTC	TCP	1186 · HTTP	http	SSRF interne ssrf internal · via HTTP:1186 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 50
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1186 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Type « SSRF interne » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 50 Confiance : Confiance 50 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux CRS-920350 Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:1186 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:1186 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/a Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"203b899119a360c8714eb461db5546268ca7d5c0","http_host_hash":"0a0bb9c77322938ec33d799c6468be341994bc8a","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"2788be9eab774ba94549e9c42cadf90a1bac87ca","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":692,"payload_entropy":5.536195517747153,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":1186,"risk_waf":84,"risk_classification":80,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":84,"classification":80,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":50,"tag_count":3,"anomaly_count":0,"campaign_key":"eb7bd6cd422e2a31024b708c5490e62fbdee4205","event_fingerprint":"3cc152a1fbe23e4d14bec5245f5f2f5f2b06ce26","classification_reason":"Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":64,"precision_signals":["CRS-920350"],"kb_rule_ids":["CRS-920350"],"confidence_breakdown":{"waf":84,"classification":80,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":50},"named_classification_skipped":false,"classification_parent":"ssrf_attack","service_name":"http","risk_confidence_factor":50,"ci…
29/10/2026 15:32:28 UTC	TCP	5911 · HTTP	http	SSRF ssrf attack · via HTTP:5911 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 53
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5911 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:5911 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:5911 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/we Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"7d8d41bb5252dcdaae44af38e2c1f406031b4d02","http_host_hash":"89ecea61b3cbb97d5c60116ddcf9ecb921932c6d","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"a4dfc0fd467d152337f7caff3c84c849a65adec4","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":702,"payload_entropy":5.522815806971029,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":5911,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.4,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":53,"tag_count":3,"anomaly_count":0,"campaign_key":"16cc771c231f7a7398acc69b1c1d09efa6927d8a","event_fingerprint":"50eab69412e2b1b538a48a7e5a603c20f2a49af7","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":53},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter…
29/10/2026 11:25:00 UTC	TCP	1840 · HTTP	http	SSRF ssrf attack · via HTTP:1840 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1840 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 52 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:1840 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:1840 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/we Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"88da84b12a904b3b33e36792a361fcbef2c81091","http_host_hash":"9e48fa5f5e9d16de385ce1803e45ae53e3a771b0","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"ecfef90dfe32b44bb4013debf9390e81827f7561","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":704,"payload_entropy":5.522240209623393,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":1840,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.8,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":52,"tag_count":3,"anomaly_count":0,"campaign_key":"b8d258600a419c45d9c94c3558b7b0998f445768","event_fingerprint":"063ca954b3e6af630f5f1ccb436b62f9f3864690","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":52},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter…
29/10/2026 09:40:02 UTC	TCP	24800 · HTTP	http	SSRF ssrf attack · via HTTP:24800 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 50
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 24800 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 50 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:24800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.3 Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:24800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,i Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"0ee6da41ec05a537578512680117eb768569b88f","http_host_hash":"6b41f2d71f8dad653b542cda80713654c6b1e793","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"178acfda628c40d9fdc65d60c7da7533f49b4c27","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":719,"payload_entropy":5.5494931294141425,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":24800,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":1,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":50,"tag_count":3,"anomaly_count":0,"campaign_key":"dbf31fb80a24010de9bd60398500a481dce93823","event_fingerprint":"a55a977e339d6218cd5724474e5c1de042c78e90","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":50},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter…
29/10/2026 08:41:26 UTC	TCP	3772 · HTTP	http	SSRF ssrf attack · via HTTP:3772 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 53
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3772 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:3772 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:3772 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/we Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"7d8d41bb5252dcdaae44af38e2c1f406031b4d02","http_host_hash":"baddb62edf633c59f2747ba6b072d94207cafe0f","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"4bbef8c1c489e20a21a645437aa4e4b3578e4aa7","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":710,"payload_entropy":5.549968465736567,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":3772,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.4,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":53,"tag_count":3,"anomaly_count":0,"campaign_key":"fcf7c2fef09dd97d7ed089964daa4fe39a3b38e0","event_fingerprint":"4df6e4c2d4f454bef0f7aa947a0edc29097cf092","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":53},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter…
28/10/2026 16:43:15 UTC	TCP	9193 · HTTP	http	SSRF ssrf attack · via HTTP:9193 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 53
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9193 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 53 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:9193 User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:9193 User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/web Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"0569fc2c4218f252667aab24d1ed1c0b9864b170","http_host_hash":"52446b79307f38a882952c29bf4ed7d8c6668433","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"22432d6e13ec5bb9b225c4c9992c3bcbada6127d","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":682,"payload_entropy":5.545679140984919,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":9193,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.8,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":53,"tag_count":3,"anomaly_count":0,"campaign_key":"34797d178dc35f465418595098c086b74070d057","event_fingerprint":"ad4b7f0257a5b7df7d9bbc72c399be69810e3a49","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":53},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter…
28/10/2026 15:43:49 UTC	TCP	2038 · HTTP	http	SSRF ssrf attack · via HTTP:2038 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 54
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2038 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 54 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2038 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2038 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/we Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"3ad6239d546f85a90c7e390ea771721e9996325a","http_host_hash":"975d4a8bcb15b25464ce755729f26db41ae47167","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"f106839eae7a8b39c5d7acb265c528d3b908cd15","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":682,"payload_entropy":5.5375127322184134,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":2038,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.7,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":54,"tag_count":3,"anomaly_count":0,"campaign_key":"102a6b67baee759999163d43d8b346689f6c7bb1","event_fingerprint":"fabe0bc62dd001d8ffd2f21e3e692e898378dea7","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":54},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacente…
28/10/2026 13:01:31 UTC	TCP	3851 · HTTP	http	SSRF interne ssrf internal · via HTTP:3851 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 50
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3851 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Type « SSRF interne » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 50 Confiance : Confiance 50 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux CRS-920350 Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:3851 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:3851 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/we Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"a59f95a8015e4271637162cf42ba0fb688b4d94a","http_host_hash":"837a94b085cd6535089651d44740119c048f5b8d","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"b4dec9284fbf8b0b72f0f557b7c4cabb9483ec5d","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":685,"payload_entropy":5.521307559260112,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":3851,"risk_waf":84,"risk_classification":80,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.2,"risk_breakdown":{"waf":84,"classification":80,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":50,"tag_count":3,"anomaly_count":0,"campaign_key":"be9fc8d97daaa0871c37686d2e8bec729a963d76","event_fingerprint":"98ebdfcad366f09cfe5864548e224461449bb7eb","classification_reason":"Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":64,"precision_signals":["CRS-920350"],"kb_rule_ids":["CRS-920350"],"confidence_breakdown":{"waf":84,"classification":80,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":50},"named_classification_skipped":false,"classification_parent":"ssrf_attack","service_name":"http","risk_confidence_factor":50,"ci…
28/10/2026 09:59:09 UTC	TCP	16831 · HTTP	http	SSRF ssrf attack · via HTTP:16831 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 54
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 16831 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 54 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:16831 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.3 Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:16831 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,i Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"a0c0d6e2beb320dd7827b3c8ec5dcb1f0c7ac4b5","http_host_hash":"5e1c8df6f2a9f1bdd3ce3bf6e309907223114e29","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"a7b58493f7c490b848b1ad482ab550c8e3cbf5d7","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":722,"payload_entropy":5.537397190422904,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":16831,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.7,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":54,"tag_count":3,"anomaly_count":0,"campaign_key":"949be9a480521dd52c76bacbeeec3dfdb185a767","event_fingerprint":"6ff8ce8c2a9b6ab06a37d57c9df0058e052533a7","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":54},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacente…
28/10/2026 03:12:40 UTC	TCP	6580 · HTTP	http	SSRF ssrf attack · via HTTP:6580 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 51
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6580 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 51 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:6580 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:6580 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/we Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"65bef8a6d399fb1ddd54830bb0dea8bbc379e21a","http_host_hash":"7c8a9ec09eac342fb31ac40e1b79da6c64856c82","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"ae71cbc5acf96ea25540ca0c79c9c07b836039bb","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":713,"payload_entropy":5.538797347449867,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":6580,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":51,"tag_count":3,"anomaly_count":0,"campaign_key":"eb4f491312419616f789151434b1e5d4e8e343ab","event_fingerprint":"a9c366dcb99b8b3d7bc50dfe980dd5e72dfb8c40","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":51},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter…
28/10/2026 03:11:55 UTC	TCP	6565 · HTTP	http	SSRF ssrf attack · via HTTP:6565 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 54
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6565 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 54 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:6565 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:6565 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/a Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"350f1a28b6cca91e1c7d068bd67d9fa56627e93d","http_host_hash":"d660b88137eb5d75532e354b380e647bc8c04581","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"14d416f489c6a3d79f92a6c14659753af5ed1906","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":694,"payload_entropy":5.53109687176868,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":6565,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.9,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":54,"tag_count":3,"anomaly_count":0,"campaign_key":"fdb650edb559a0bc98bb777bf63957483df64de0","event_fingerprint":"af683598f43cfce5e5a47e16ac89014aacdf84d2","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":54},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter"…
27/10/2026 21:25:06 UTC	TCP	4150 · HTTP	http	SSRF ssrf attack · via HTTP:4150 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 54
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4150 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 54 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:4150 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:4150 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,applica Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"c8b4d37b38b1799165338e01276e4a03c6dbe86a","http_host_hash":"808c9d47c054ff5427be59e4c491794cea6b9e3b","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"a076fa651fccbc3d4f39d7d9c6133f7e89dd1bca","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":674,"payload_entropy":5.487079890281036,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":4150,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.4,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":54,"tag_count":3,"anomaly_count":0,"campaign_key":"050ca076c3b755ee727982092bddf95b1c82b639","event_fingerprint":"4a570bb82c1564ca920468b6331075bf2a41a07d","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":54},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter…
27/10/2026 14:25:43 UTC	TCP	8800 · HTTP	http	SSRF ssrf attack · via HTTP:8800 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 54
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8800 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 54 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.7204.92 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:8800 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:8800 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.7204.92 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,imag Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"e2aab42e83db4fb41974cf865032aeff843c863a","http_host_hash":"7bcd279d4417b56f827a93b5d7ca5fded437b0c7","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"9204816e821a68034f39b2bf04e7e25e0f8cccba","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":713,"payload_entropy":5.559309469016396,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":8800,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.4,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":54,"tag_count":3,"anomaly_count":0,"campaign_key":"27ba9aae7c9ca2003add19ffa41ab918d1bd4096","event_fingerprint":"ff73296553a6de777fc93e2e019bb65d98ff9451","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":54},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter…
27/10/2026 12:07:50 UTC	TCP	9062 · HTTP	http	SSRF ssrf attack · via HTTP:9062 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 51
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9062 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 51 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:9062 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:9062 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/a Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"041223a463c7548505e91f17600a6794508aa066","http_host_hash":"30b83a716f02ae414a0a840e6c45d4e4a74741eb","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"91ca5f35c8fc42e558ec4731dfb4eb3cb1319007","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":671,"payload_entropy":5.532750624942551,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":9062,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":51,"tag_count":3,"anomaly_count":0,"campaign_key":"d96b3545d36165bf2997f251fafdfd17a205854a","event_fingerprint":"55f5d4c7571a2f2a92a824785fa16eeff776b43f","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":51},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter…
27/10/2026 11:03:22 UTC	TCP	2455 · HTTP	http	SSRF ssrf attack · via HTTP:2455 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 51
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET /favicon.ico UA Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefo… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2455 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 51 Confiance : Confiance 50 % — 3 tag(s) WAF Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0 Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2455 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/1 Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2455 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signe Meta JSON brut {"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"6befef60a2383c468a0dc43eb9fa222cafd7a552","http_host_hash":"7748c4f1c67470335fd3068feb39ff955beace37","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"aa5eb2b7be5102193eb4e82c4becd9c87b78c169","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":644,"payload_entropy":5.514352166252086,"port_category":"registered","org":"Detai Prosperous Technologies Limited","service":"http","app_proto":"http","asn":212512,"country":"US","dst_port":2455,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":2,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":51,"tag_count":3,"anomaly_count":0,"campaign_key":"ef85e2313908c6be911871cf8c5d97332fb04ab3","event_fingerprint":"c105c1180ddc4427a78f6db9688346e0995da325","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":51},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter":…

45.131.155.103

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence