Fiche IP

Allemagne

45.135.194.42

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — multi-protocole (403 protocoles · 5 min)

Campagne multi-ports détectée sur une fenêtre courte

FAI Pfcloud UG (haftungsbeschrankt) Première vue 16/10/2026 04:10 UTC Dernière vue 17/10/2026 23:35 UTC Risque Moyen

Période 2026-10-01 → 2026-10-31

Moyen 42/100

24h 7j 30j 90j

Synthèse

Score de risque max. 42/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 16/10/2026 04:10 UTC

Dernière observation 17/10/2026 23:35 UTC

Événements (période) 1,492

Décision conseillée Surveiller Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal T1046 1486 occurrences

Pourquoi listée

Type « Scan de ports » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 8 · Bonus corrélation +23

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

42/100 Confiance 100 % 1,492 événements T1046

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 45.135.194.42
Décision : Investiguer
Score max : 42/100 (Moyen)
Confiance : 100 %
Période : 2026-10-01 → 2026-10-31 · 1492 événements
Motif : Type « Scan de ports » (signaux protocolaires) · confiance 100%
MITRE : T1046
FAI : Pfcloud UG (haftungsbeschrankt) · Allemagne

Comparaison ASN / FAI

ASN 51396 · 45.135.194.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 1,492 événements sur la période pour cette IP.

176.65.148.94 Spray credentials 28/10/2026 20:15 UTC
94.183.174.99 Sonde fichier configuration 28/10/2026 00:09 UTC
204.76.203.7 file upload abuse 24/10/2026 11:06 UTC
176.65.148.184 Traversal LFI 24/10/2026 10:37 UTC
176.65.149.253 Sonde Minecraft 22/10/2026 13:30 UTC
204.76.203.4 Sonde port 22/10/2026 13:29 UTC
176.65.148.226 Sonde Minecraft 22/10/2026 12:39 UTC
45.135.194.24 Sonde HTTP 22/10/2026 09:58 UTC

Événements (filtres)

1,492

Première observation

16/10/2026 04:10 UTC

Dernière observation

17/10/2026 23:35 UTC

Dernière activité (filtres)

17/10/2026 23:35 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

—

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 405 TLS TCP 132 SMB TCP 16 VNC TCP 9 RPCBIND TCP 8 IMAP TCP 8 KAFKA SSL TCP 8 FINGER TCP 8 LOGIN TCP 8 PPTP TCP 8 ECHO TCP 8 SMTP SUBMISSION TCP 8 SMTP TCP 8 KSHELL TCP 8 JETDIRECT TCP 8 SMTP ALT TCP 8 FTP TCP 8 RDP TCP 8 RTSP TCP 8 SMTPS TCP 8

HTTP

405

TLS

132

SMB

VNC

RPCBIND

IMAP

Géolocalisation

Origine réseau déclarée

Allemagne unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Pfcloud UG (haftungsbeschrankt) 0 Port 7000 Scan de ports

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · port 8296 · (reconnaissance)

Détails protocole

Port / service

8296

Raison confiance

Confiance 100 % — 1 signal(aux) capteur

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S

Confiance

100% Corrélation +23

Famille de menace

scanner

MITRE ATT&CK — tactiques observées

Reconnaissance

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

1,492 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

1492 événement(s) — page 2/60

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
17/10/2026 23:35:55 UTC	TCP	8545 · ETH RPC	eth-rpc	Scan de ports port scan syn · via ETH RPC:8545 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole Émulateur ETH-RPC WAF — Recommandation Surveiller Tags net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8545 Chemin / cible — Service ETH RPC Payload ��wy�$7P�kx%p�)��S{�� >u�� 1�8q[h9=��bG�P�@Y�ȫhoV��+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��wy�$7P�kx%p�)��S{�� >u�� 1�8q[h9=��bG�P�@Y�ȫhoV��+�/�,�0̨̩� �� [� Requête brute (extrait) ��wy�$7P�kx%p�)��S{�� >u�� 1�8q[h9=��bG�P�@Y�ȫhoV��+�/�,�0̨̩� �� [ � � 2+3���3�}�)ǂ<�W��R#l�",G� Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f74206574685f72706320726561647920706f72743d383534350d0a","emulator_response_len":38,"bytes_in":1479,"payload_entropy":7.724492826894082,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"eth-rpc","app_proto":"eth-rpc","asn":51396,"country":"DE","dst_port":8545,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":15},"risk_score":42,"tag_count":2,"anomaly_count":0,"campaign_key":"6d5c8d9ba2e7518ad8bf63bb5fb829929d2ed988","event_fingerprint":"6c6e33f0d74faeda6ee9a25929b271d2e77f53d0","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":…
17/10/2026 23:35:55 UTC	TCP	8531 · TLS	tls	Scan de ports port scan syn · via TLS:8531 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8531 Chemin / cible — Service TLS Payload ����Z2�;¹Fp�+�ROm n{��3ʄ�� +��YLkk�}1'<��ׂX��xl�m�+�/�,�0̨̩� �� [ � Pourquoi cette classification :* Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ����Z2�;¹Fp�+�ROm n{��3ʄ�� +��YLkk�}1'<��ׂX��xl�m�+�/�,�0̨̩� �� [� Requête brute (extrait) ����Z2�;¹Fp�+�ROm n{��3ʄ�� +��YLkk�}1'<��ׂX��xl�m�+�/�,�0̨̩� �� [ � � 2+3��,HǬi��\�?��7𐦴�fj7�׾�8 Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.7362424283414155,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8531,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"93ae17f59574373eb1d214bcd6bdbcf6190f3323","event_fingerprint":"b3d63c8d6a46f7ca184364088c5ed7b44fdb7de4","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"nam…
17/10/2026 23:35:55 UTC	TCP	8529 · ARANGODB	arangodb	Scan de ports port scan syn · via ARANGODB:8529 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole Émulateur ARANGODB WAF — Recommandation Surveiller Tags arangodb_emulated arangodb_payload net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8529 Chemin / cible — Service ARANGODB Payload ��Ѕ��N�2��t�iB��F��Qߵe>�n�$P H�̭b��gwn��7��-�J%�Փr}��+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Ѕ��N�2��t�iB��F��Qߵe>�n�$P H�̭b��gwn��7��-�J%�Փr}��+�/�,�0̨̩� �� [� Requête brute (extrait) ��Ѕ��N�2��t�iB��F��Qߵe>�n�$P H�̭b��gwn��7��-�J%�Փr}��+�/�,�0̨̩� �� [ � � 2+3��k�Y�.z��k��Փ�`ReW5�� Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f74206172616e676f646220726561647920706f72743d383532390d0a","emulator_response_len":39,"bytes_in":1479,"payload_entropy":7.761586036080159,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"arangodb","app_proto":"arangodb","asn":51396,"country":"DE","dst_port":8529,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"c068c0ffeb46e9c8098d3fcde2d3beb22dc7a843","event_fingerprint":"4661ec28198c7b188487efa04ef7325d1aa99d6f","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification…
17/10/2026 23:35:55 UTC	TCP	8532 · TLS	tls	Scan de ports port scan syn · via TLS:8532 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8532 Chemin / cible — Service TLS Payload ��,-�e�%��3��q}��+]��FxW` ��r�_���A��W�E�'[b�+�/�,�0̨̩� �� [ � Pourquoi cette classification :* Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��,-�e�%��3��q}��+]��FxW` ��r�_���A��W�E�'[b�+�/�,�0̨̩� �� [� Requête brute (extrait) ��,-�e�%��3��q}��+]��FxW` ��r�_���A��W�E�'[b�+�/�,�0̨̩� �� [ � � 2+3��\ˮ�R qN# A�S�h�ӆJ�4�@M� Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.744585002397869,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8532,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"84e71f9b9fcb1bb46b7615ebade1dbc60ca505d3","event_fingerprint":"b64c428131dcdbc4b4770fd4d478e7805d9e707b","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"na…
17/10/2026 23:35:55 UTC	TCP	8533 · TLS	tls	Scan de ports port scan syn · via TLS:8533 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8533 Chemin / cible — Service TLS Payload ��/�� )�/�]�!��/�� +�� n]FF�m��y� �b��Wg�S�ч=l��+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��/��)�/�]�!��/�� +�� n]FF�m��y� �b��Wg�S�ч=l��+�/�,�0̨̩� �� [� Requête brute (extrait) ��/�� )�/�]�!��/�� +�� n]FF�m��y� �b��Wg�S�ч=l��+�/�,�0̨̩� �� [ � � 2+3��ftf�t��W�v�\|��JS�u P�(� \ Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.726505028124933,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8533,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"3e0065a60f4a745e7104b9d11f93af720aa21bb7","event_fingerprint":"c5d8d0f3c7db35e97f36a65309a92ff26a896b7b","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"na…
17/10/2026 23:35:55 UTC	TCP	8530 · TLS	tls	Scan de ports port scan syn · via TLS:8530 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8530 Chemin / cible — Service TLS Payload ��bMи1L�I�!�~XԴs$=i�W�q�� dC�?�� !�Z�Ȧ�E}�м9��Ao�+�/�,�0̨̩� �� [ � Pourquoi cette classification :* Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��bMи1L�I�!�~XԴs$=i�W�q�� dC�?��!�Z�Ȧ�E}�м9��Ao�+�/�,�0̨̩� �� [� Requête brute (extrait) ��bMи1L�I�!�~XԴs$=i�W�q�� dC�?�� !�Z�Ȧ�E}�м9��Ao�+�/�,�0̨̩� �� [ � � 2+3�� >��[G�Fo~��(1 �!�%(s�" Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.756091271895253,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8530,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.8,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"30af3dcb3ab6072245754b5b6fbf4616984d56a3","event_fingerprint":"d38d947547eb1d6e87297f6142730455eeaf7c1c","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"na…
17/10/2026 23:35:55 UTC	TCP	8519 · TLS	tls	Scan de ports port scan syn · via TLS:8519 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8519 Chemin / cible — Service TLS Payload ��Ҡ&h��)��Gw�Q��J�=��u�V.� U^��ڙ��<G� ("xG�,��Fh��+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Ҡ&h��)��Gw�Q��J�=��u�V.� U^��ڙ��<G� ("xG�,��Fh��+�/�,�0̨̩� �� [� Requête brute (extrait) ��Ҡ&h��)��Gw�Q��J�=��u�V.� U^��ڙ��<G� ("xG�,��Fh��+�/�,�0̨̩� �� [ � � 2+3��D�w��K�)nq5HЊ��c t"ʷ,�� Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.698978670135739,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8519,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"03d12e12e6c952a83ee43c108423ef2afaa9517b","event_fingerprint":"fe14d702b968ef167a9dffb672692da4f556caee","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"name…
17/10/2026 23:35:55 UTC	TCP	8518 · TLS	tls	Scan de ports port scan syn · via TLS:8518 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8518 Chemin / cible — Service TLS Payload ��}��Ux��e�X��5o ��F�K<�� $�i7W��y��I�O�U'y�&\|�N#�+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��}��Ux��e�X��5o ��F�K<�� $�i7W��y��I�O�U'y�&\|�N#�+�/�,�0̨̩� �� [� Requête brute (extrait) ��}��Ux��e�X��5o ��F�K<�� $�i7W��y��I�O�U'y�&\|�N#�+�/�,�0̨̩� �� [ � � 2+3�� 7��Y�ޫ�i��E�_d< �[G�_�: Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.7236393173176925,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8518,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"22b749f7e9d414eb2138f3ea57c956580a36e075","event_fingerprint":"eb7474dbafd6efbf268a3d7f6851ed39a815224b","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"n…
17/10/2026 23:35:55 UTC	TCP	8517 · TLS	tls	Scan de ports port scan syn · via TLS:8517 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8517 Chemin / cible — Service TLS Payload ��-�e�{&f.>��j�,�i5�9�~I(a�0� �)<�6��E��z21�1k0M X�lX"Aj�'�+�+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��-�e�{&f.>��j�,�i5�9�~I(a�0� �)<�6��E��z21�1k0M X�lX"Aj�'�+�+�/�,�0̨̩� �� [� Requête brute (extrait) ��-�e�{&f.>��j�,�i5�9�~I(a�0� �)<�6��E��z21�1k0M X�lX"Aj�'�+�+�/�,�0̨̩� �� [ � � 2+3��8W�R�g��[�\��Ƈ��#�E�ܚ�Iu Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.723748076814649,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8517,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.7,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"1490968ed8c70794e120196dbc5ae85e798a05d4","event_fingerprint":"9a3cad7de6c2e44f1f47e28263006006c5d15e5f","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"na…
17/10/2026 23:35:54 UTC	TCP	1080 · SOCKS5	socks5	Scan de ports port scan syn · via SOCKS5:1080 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_flood socks5_emulated tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload ��茵��_�\|�rm��3[!��V�5�) ��Oh�+�p@��3ϴP�t��S�o��+�/�,�0̨̩� �� [ � Pourquoi cette classification :* Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��茵��_�\|�rm��3[!��V�5�) ��Oh�+�p@��3ϴP�t��S�o��+�/�,�0̨̩� �� [� Requête brute (extrait) ��茵��_�\|�rm��3[!��V�5�) ��Oh�+�p@��3ϴP�t��S�o��+�/�,�0̨̩� �� [ � � 2+3��"<jM�b�(.�w�u@MJJ�\79�>� Meta JSON brut {"protocol_emulated":true,"bytes_in":1479,"payload_entropy":7.767933609838889,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"socks5","app_proto":"socks5","asn":51396,"country":"DE","dst_port":1080,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"b0c2366a3d46ff3ecf1ae5dbde0d043f5fa7247d","event_fingerprint":"58326ea1b700407bfff5f067507bcf4d2f7016fe","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,…
17/10/2026 23:35:54 UTC	TCP	8538 · TLS	tls	Scan de ports port scan syn · via TLS:8538 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8538 Chemin / cible — Service TLS Payload ��M$�_��tFV��'��Q_� �p�^��g��a�Ȱ��D`�tu��Q]�S�+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��M$�_��tFV��'��Q_� �p�^��g��a�Ȱ��D`�tu��Q]�S�+�/�,�0̨̩� �� [� Requête brute (extrait) ��M$�_��tFV��'��Q_� �p�^��g��a�Ȱ��D`�tu��Q]�S�+�/�,�0̨̩� �� [ � � 2+3��TkQ�K�(��/� ^��r{\|7e� Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.722143468942131,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8538,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"455c2966397805be5485e95f182d6c2f9012c669","event_fingerprint":"a9ce5155972412844b91f37c112f4e2e5aae8096","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"na…
17/10/2026 23:35:54 UTC	TCP	8536 · TLS	tls	Scan de ports port scan syn · via TLS:8536 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8536 Chemin / cible — Service TLS Payload ��-��{g`�C��Y� % ��zxʀ:��A�& ,�B�v=`�2e<&�װ�� }�dG��&�+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��-��{g`�C��Y� % ��zxʀ:��A�& ,�B�v=`�2e<&�װ��}�dG��&�+�/�,�0̨̩� �� [� Requête brute (extrait) ��-��{g`�C��Y� % ��zxʀ:��A�& ,�B�v=`�2e<&�װ�� }�dG��&�+�/�,�0̨̩� �� [ � � 2+3��`D��>ȣ��+@ZOP�8��=xTk`& Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.711220629745727,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8536,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.8,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"6f3fdc97674d83de69c4102386318ace84d4bf70","event_fingerprint":"184c955e02cb157a7a6c36cca3dc0042d393bd83","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"na…
17/10/2026 23:35:54 UTC	TCP	8357 · TLS	tls	Scan de ports port scan syn · via TLS:8357 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8357 Chemin / cible — Service TLS Payload ��4 m��Ծ��SG�N�^-2c��V�C�#ش�Z ��nsH�vjq� M{t�� 5ZW�ǥ�+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��4 m��Ծ��SG�N�^-2c��V�C�#ش�Z ��nsH�vjq�M{t�� 5ZW�ǥ�+�/�,�0̨̩� �� [� Requête brute (extrait) ��4 m��Ծ��SG�N�^-2c��V�C�#ش�Z ��nsH�vjq� M{t�� 5ZW�ǥ�+�/�,�0̨̩� �� [ � � 2+3��sP]� ��m1��6'��Q(�Pq� Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.729710827284346,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8357,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"d4ede925d66875e8fc95437ba11b00a95272d68d","event_fingerprint":"ce0cd82c16c29d674cd2c8e5d7dd66e3f5c3585e","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"na…
17/10/2026 23:35:54 UTC	TCP	8349 · TLS	tls	Scan de ports port scan syn · via TLS:8349 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8349 Chemin / cible — Service TLS Payload ��tcLT��u�[+yy�%� 7�a�v��Xj��y�E�E0�A��+�/�,�0̨̩� �� [ � Pourquoi cette classification :* Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��tcLT��u�[+yy�%� 7�a�v��Xj��y�E�E0�A��+�/�,�0̨̩� �� [� Requête brute (extrait) ��tcLT��u�[+yy�%� 7�a�v��Xj��y�E�E0�A��+�/�,�0̨̩� �� [ � � 2+3��?�'��I��1�\|=�E�9�_J� Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.741990826916647,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8349,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"37942dc5176e8e47fa4c10f45d884f29c183fdd4","event_fingerprint":"e1b84c497dd438e8f09ee3f741698fb440830943","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"na…
17/10/2026 23:35:54 UTC	TCP	8348 · TLS	tls	Scan de ports port scan syn · via TLS:8348 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8348 Chemin / cible — Service TLS Payload ��:t��=��&�� w#nJ쇋�׬-��gnRRP ��`��N��g�o P��bL}�� (��+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��:t��=��&�� w#nJ쇋�׬-��gnRRP ��`��N��g�oP��bL}��(��+�/�,�0̨̩� �� [� Requête brute (extrait) ��:t��=��&�� w#nJ쇋�׬-��gnRRP ��`��N��g�o P��bL}�� (��+�/�,�0̨̩� �� [ � � 2+3��A�!��.J�$�hJv�_nz��2 Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.740601205701326,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8348,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"4f8dfdbadebaf9ea406f64655ed501457af111ce","event_fingerprint":"57c8e54d469a8b287f4b9f4e774f989120b67ac1","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"na…
17/10/2026 23:35:54 UTC	TCP	8356 · TLS	tls	Scan de ports port scan syn · via TLS:8356 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8356 Chemin / cible — Service TLS Payload ��5O��G5��`�W� X9lR!�r�Y l`w��$OB��֋3�]Z,?� tY��+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��5O��G5��`�W� X9lR!�r�Y l`w��$OB��֋3�]Z,?� tY��+�/�,�0̨̩� �� [� Requête brute (extrait) ��5O��G5��`�W� X9lR!�r�Y l`w��$OB��֋3�]Z,?� tY��+�/�,�0̨̩� �� [ � � 2+3�� G�z�ㆻ~�!�F�ƃ�[�5pc� Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.746110054479681,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8356,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.8,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"79b7c4956d499801010c2b1c13db2688e267544f","event_fingerprint":"9ce115e74c0c9d2aca0307dbe8814943b551015d","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"na…
17/10/2026 23:35:54 UTC	TCP	8351 · TLS	tls	Scan de ports port scan syn · via TLS:8351 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8351 Chemin / cible — Service TLS Payload ��g;�q ��}S�c�ʹ �ē�oj��[� �2\|��,R� - �5a��&�2<��+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��g;�q ��}S�c�ʹ �ē�oj��[� �2\|��,R� - �5a��&�2<��+�/�,�0̨̩� �� [� Requête brute (extrait) ��g;�q ��}S�c�ʹ �ē�oj��[� �2\|��,R� - �5a��&�2<��+�/�,�0̨̩� �� [ � � 2+3��1Rp�\|�&��AJDlZJz�f�6�;k Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.726543538184145,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8351,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"723d3cc873aac4c802802fca65f6307308db5cd4","event_fingerprint":"3de0df3c6da8cda3a6eefc4a86794001851db180","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"name…
17/10/2026 23:35:54 UTC	TCP	4000 · REMOTEANYTHING	remoteanything	Scan de ports port scan syn · via REMOTEANYTHING:4000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole Émulateur REMOTEANYTHING WAF — Recommandation Surveiller Tags net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4000 Chemin / cible — Service REMOTEANYTHING Payload �� 0��[&>��\�b,<��[�=A�� !1�� ּ>��\�m��`-fU��n��+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �� 0��[&>��\�b,<��[�=A�� !1�� ּ>��\�m��`-fU��n��+�/�,�0̨̩� �� [� Requête brute (extrait) �� 0��[&>��\�b,<��[�=A�� !1�� ּ>��\�m��`-fU��n��+�/�,�0̨̩� �� [ � � 2+3��`� �r�t\��[@�'�*O�0Os�#�>�q Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a","emulator_response_len":45,"bytes_in":1479,"payload_entropy":7.740672164680451,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"remoteanything","app_proto":"remoteanything","asn":51396,"country":"DE","dst_port":4000,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":0.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":15},"risk_score":42,"tag_count":2,"anomaly_count":0,"campaign_key":"b41747e32ef28f6b1af764b5816f70196d9da395","event_fingerprint":"6e546825913af94cb1b669852b6bdd8a5b18530c","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown…
17/10/2026 23:35:54 UTC	TCP	5002 · UPNP SSL	upnp-ssl	Scan de ports port scan syn · via UPNP SSL:5002 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole Émulateur UPNP-SSL WAF — Recommandation Surveiller Tags net_flood tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5002 Chemin / cible — Service UPNP SSL Payload ��+S:��s��vb�/x��}��]j�r�q�� I\L�_��3B�! R�5?6�O��4��3��+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��+S:��s��vb�/x��}��]j�r�q�� I\L�_��3B�!R�5?6�O��4��3��+�/�,�0̨̩� �� [� Requête brute (extrait) ��+S:��s��vb�/x��}��]j�r�q�� I\L�_��3B�! R�5?6�O��4��3��+�/�,�0̨̩� �� [ � � 2+3��,��JR{�)�(jt�bH�H`�Y;Bɓ� Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f742075706e705f73736c20726561647920706f72743d353030320d0a","emulator_response_len":39,"bytes_in":1479,"payload_entropy":7.736005180488765,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"upnp-ssl","app_proto":"upnp-ssl","asn":51396,"country":"DE","dst_port":5002,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":15},"risk_score":42,"tag_count":2,"anomaly_count":0,"campaign_key":"034a619f3e678250ea9fbd73e0df2fc0f7896154","event_fingerprint":"77971cd150c68f8beb6bb6016a32ea524ebd6907","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classificati…
17/10/2026 23:35:54 UTC	TCP	8355 · TLS	tls	Scan de ports port scan syn · via TLS:8355 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8355 Chemin / cible — Service TLS Payload ��<* �F�~I��\|��uI��Q�v�/}�RM �f�n]��}��2Č"�ͨB�2�JZNl%��+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��<�F�~I��\|��uI��Q�v�/}�RM �f�n]��}��2Č"�ͨB�2�JZNl%��+�/�,�0̨̩� �� [� Requête brute (extrait) ��< �F�~I��\|��uI��Q�v�/}�RM �f�n]��}��2Č"�ͨB�2�JZNl%��+�/�,�0̨̩� �� [ � � 2+3��#�1��Ş�@SA�@ L̛[%L�D�� Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.704617741374568,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8355,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.6,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"40e5e80f7076a9315ff5b64f12973c951b635034","event_fingerprint":"08850fb7f7dfdb37390ffd15bef715032c8752fe","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"na…
17/10/2026 23:35:54 UTC	TCP	8346 · TLS	tls	Scan de ports port scan syn · via TLS:8346 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8346 Chemin / cible — Service TLS Payload �� r\��d_�+�uw��:P� �K�A��`�o߁YW��&O��S�]�;�i�+�/�,�0̨̩� �� [ � Pourquoi cette classification :* Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��r\��d_�+�uw��:P� �K�A��`�o߁YW��&O��S�]�;�i�+�/�,�0̨̩� �� [� Requête brute (extrait) �� r\��d_�+�uw��:P� �K�A��`�o߁YW��&O��S�]�;�i�+�/�,�0̨̩� �� [ � � 2+3��D�G��s��;u��3E�8V �)2� Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.729339712802809,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8346,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"6109423c5b16b0ca3096212880b70258a3ca5286","event_fingerprint":"007412e585102d0a59de3e152dd18abf1012afd8","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"na…
17/10/2026 23:35:54 UTC	TCP	8340 · TLS	tls	Scan de ports port scan syn · via TLS:8340 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8340 Chemin / cible — Service TLS Payload ��p�Ӟ�9K��F��g>��P�Z�R�YU� �qi��?n��F��r��-��=��+�/�,�0̨̩� �� [ � Pourquoi cette classification :* Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��p�Ӟ�9K��F��g>��P�Z�R�YU� �qi��?n��F��r��-��=��+�/�,�0̨̩� �� [� Requête brute (extrait) ��p�Ӟ�9K��F��g>��P�Z�R�YU� �qi��?n��F��r��-��=��+�/�,�0̨̩� �� [ � � 2+3��>#WΟL:$v7�Xe��̳hΈ�}B Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.7595298317475265,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8340,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"80ac94a7f8a98e6d1efc42f6a73bcebb74849652","event_fingerprint":"ca1d3d434f65c563e625bb39b840384e8b233e4c","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"n…
17/10/2026 23:35:54 UTC	TCP	8347 · TLS	tls	Scan de ports port scan syn · via TLS:8347 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8347 Chemin / cible — Service TLS Payload ��3��Lf��CL#��K^1E��d��V y��9��9�&$-��4��m[�8���+�/�,�0̨̩� �� [ � Pourquoi cette classification :* Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Sigma DNP3 link PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��3��Lf��CL#��K^1E��d��V y��9��9�&$-��4��m[�8���+�/�,�0̨̩� �� [� Requête brute (extrait) ��3��Lf��CL#��K^1E��d��V y��9��9�&$-��4��m[�8���+�/�,�0̨̩� �� [ � � 2+3��ȇkǚɅ[ϱ?�F?tg��g�W��/h� Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.74187167642197,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8347,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"e891b82dd8d4c376c97e31180bbfe9904dec55df","event_fingerprint":"52011106a33a43265287bb0c87c6cfdb4d6766c4","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0794","pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["Sigma DNP3 link","PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0794","pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"ris…
17/10/2026 23:35:54 UTC	TCP	8342 · TLS	tls	Scan de ports port scan syn · via TLS:8342 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8342 Chemin / cible — Service TLS Payload ��cp��p�}��DJD�?OD'�w�Ie�J �+\U�I�fJ,�"��$�� sݐ�]Ƀ3�+�/�,�0̨̩� �� [ � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��cp��p�}��DJD�?OD'�w�Ie�J �+\U�I�fJ,�"��$�� sݐ�]Ƀ3�+�/�,�0̨̩� �� [� Requête brute (extrait) ��cp��p�}��DJD�?OD'�w�Ie�J �+\U�I�fJ,�"��$�� sݐ�]Ƀ3�+�/�,�0̨̩� �� [ � � 2+3��5�� \|@�xt��oI��[��^5 Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.721888944524482,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8342,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"477a93853e2d587993c051b9e1c35b2ea0ec359d","event_fingerprint":"2bd2771dda8fb5e3af3d2dbd641ef7a12f5d268f","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"na…
17/10/2026 23:35:54 UTC	TCP	8341 · TLS	tls	Scan de ports port scan syn · via TLS:8341 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8341 Chemin / cible — Service TLS Payload ��􁻩];�n�6 �=o�F(�-K"�H`^�� HC��q��Z[H� ��hD��\|�%ېz9��+�/�,�0̨̩� �� [ � Pourquoi cette classification :* Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��􁻩];�n�6�=o�F(�-K"�H`^�� HC��q��Z[H��hD��\|�%ېz9��+�/�,�0̨̩� �� [� Requête brute (extrait) ��􁻩];�n�6 �=o�F(�-K"�H`^�� HC��q��Z[H� ��hD��\|�%ېz9��+�/�,�0̨̩� �� [ � � 2+3��'A;�1SKh�j% ҧ��4�Dė" Meta JSON brut {"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_sni":null,"bytes_in":1479,"payload_entropy":7.743759510196288,"port_category":"registered","org":"Pfcloud UG (haftungsbeschrankt)","service":"tls","app_proto":"tls","asn":51396,"country":"DE","dst_port":8341,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"df78138f828a2ad036c2a7600759c01aa42a8056","event_fingerprint":"16adb5789510653d0a07b18432cbf17f09e568b1","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"na…

45.135.194.42

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence