Renseignement sur les menaces

Pays-Bas

45.153.34.89

FAI TechTies Inc. Première vue 11/07/2026 07:18 UTC Dernière vue 20/07/2026 06:55 UTC Risque Moyen

Période analysée : 2026-06-21 → 2026-07-21

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — via HTTP — multi-protocole (50 protocoles · 5 min)

Campagne multi-ports détectée sur une fenêtre courte

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 53/100 Moyen

Première observation 11/07/2026 07:18 UTC

Dernière observation 20/07/2026 06:55 UTC

Événements (période) 429

MITRE ATT&CK principal T1046 425 occurrences

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — via HTTP — multi-protocole (50 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « port_scan_syn » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 8 · Bonus corrélation +23

Comparaison ASN / FAI

ASN 197170 · 45.153.34.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 429 événements sur la période pour cette IP.

93.152.221.210 Sonde HTTP 21/07/2026 23:33 UTC
45.153.34.54 Cross-site scripting 21/07/2026 22:35 UTC
91.92.42.80 Sonde port 8088/TCP 21/07/2026 21:47 UTC
45.156.87.253 Sonde SSH 21/07/2026 21:36 UTC
91.92.40.10 Agent personnel 21/07/2026 21:06 UTC
45.153.34.165 Sonde SSH 21/07/2026 19:52 UTC
45.156.87.192 Sonde HTTP 21/07/2026 19:50 UTC
45.153.34.226 Sonde HTTP 21/07/2026 19:35 UTC

Événements (filtres)

429

Première observation

11/07/2026 07:18 UTC

Dernière observation

20/07/2026 06:55 UTC

Dernière activité (filtres)

20/07/2026 06:55 UTC

Événements 7j

425

Ports distincts (7j)

133

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 286 SOCKS5 TCP 8 HTTPS TCP 6 HDFS NAMENODE TCP 4 TOR OR TCP 4 SAP ICM TCP 4 CONSUL TCP 4 COUCHBASE TCP 4 KAFKA JMX TCP 2 KERBEROS TCP 2 BITCOIN TCP 2 TOR SOCKS TCP 2 SMTP ALT2 TCP 2 JAVA RMI TCP 2 JETDIRECT TCP 2 DISCORD WEBHOOK TCP 2 SQUID ALT TCP 2

HTTP

286

SOCKS5

HTTPS

HDFS NAMENODE

TOR OR

SAP ICM

Géolocalisation

Origine réseau déclarée

Pays-Bas unknown unknown

FAI / réseau

Opérateur et dernière activité ban

TechTies Inc. 0 Port 6588 web_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · via HTTP:8009 · (reconnaissance) · → check.proxypool.sh:443

Détails protocole

Méthode: CONNECT
Chemin: check.proxypool.sh:443
User-Agent: Go-http-client/1.1

Aperçu payload

CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 User-Agent: Go-http-client/1.1

Port / service

8009 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 100 % — 4 signal(aux) capteur

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S

Confiance

100% Corrélation +23

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

429 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

429 événement(s) — page 5/9

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
20/07/2026 06:55:43 UTC	TCP	8008 · HTTP	http	Scan de ports port scan syn · via HTTP:8008 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_flood Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8008 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8008, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "f1cd133afbea8b3baa366bab3657ee6070c8b641", "event_fingerprint": "1790084dcc4a8f6ec5c277dd1cbd73648c3d4ab5", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8008, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bd137195322c873fbf9d2a0b80d4f7b2914413a2", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8008, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8008 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8008 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (42 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8008, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8008, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8008 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8008 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8008" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 117, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1085, 1086, 1087, 1088, 1089, 1090, 1091 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 117, "scan_velocity_ports_per_s": 75.5, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 42, "multi_protocol_sample": [ "bitcoin", "consul", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi", "jetdirect" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_flood" ] }
20/07/2026 06:55:43 UTC	TCP	1095	—	Scan de ports port scan syn · port 1095 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_flood socks4_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1095 Chemin / cible — Payload �" �N Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Payload (extrait) �" �N Meta JSON brut { "bytes_in": 9, "payload_entropy": 2.94770277922009, "port_category": "registered", "org": "TechTies Inc.", "service": null, "app_proto": null, "asn": 197170, "country": "NL", "dst_port": 1095, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "695c8655ee061a1fd2e1ffd95ff6dc39e59e8568", "event_fingerprint": "99f08de8ab1f78e36ef9a31a9d195320df176f42", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f6d7f72f6464e12cbf41f58650886486", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 1095, "risk_score": 42 }, "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "evidence": { "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2c7f3ad1705cb47e0ba9807a4d04a2349be52b4d", "protocol_details": { "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "port": 1095 }, "evidence_snippet": "\ufffd\"\r\ufffdN", "attack_vector": "port scan syn \u00b7 port 1095 \u00b7 (reconnaissance)", "target_port_label": "1095", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (43 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 1095, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "port": 1095 }, "attack_vector": "port scan syn \u00b7 port 1095 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\"\r\ufffdN", "target_port_label": "1095", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "1095" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 118, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1085, 1086, 1087, 1088, 1089, 1090, 1091 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 118, "scan_velocity_ports_per_s": 76.03, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 43, "multi_protocol_sample": [ "bitcoin", "consul", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi", "jetdirect" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "socks4_greeting" ] }
20/07/2026 06:55:43 UTC	TCP	3128 · HTTP	http	Scan de ports port scan syn · via HTTP:3128 · (reconnaissance)	Élevée	Moyen · 43
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3128 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 43 Confiance : Confiance 100 % — 2 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4dh HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4dh HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4dh HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "06c53c0c76377e474a3335dd28925344107a117c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.025411202261985, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 3128, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 43, "tag_count": 5, "anomaly_count": 0, "campaign_key": "c512c9b0d983b6d372dfa0a6115f32301b7a792a", "event_fingerprint": "3b6e89a82c79878cbbc71fe4586d1f338988ef06", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 43, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2eb169951262cc298aa84a2683dc2229", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dh HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4dh", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dh HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dh HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dh HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4dh", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dh HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dh HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dh HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "722e5717256b464623bc0fba91a0470358fb19b9", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dh HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dh HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance)", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (43 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 43, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dh HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dh HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 119, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1085, 1086, 1087, 1088, 1089, 1090, 1091 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 119, "scan_velocity_ports_per_s": 76.09, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 43, "multi_protocol_sample": [ "bitcoin", "consul", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi", "jetdirect" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_flood" ] }
20/07/2026 06:55:43 UTC	TCP	8100 · HTTP	http	Scan de ports port scan syn · via HTTP:8100 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8100 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4c5 HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4c5 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4c5 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "ceab2b0fd2479c3da4764bfc77ee7e2f943a9671", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.020037714057217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8100, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "c2869e438b06e8bcf23619c4163936e78b527ea2", "event_fingerprint": "7245f269ee878889267152eea153fe145083cdf5", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "01e0af139a65cf601014e2485b22e713", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8100, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4c5", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c5 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4c5", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c5 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5c9d00521f98439542bba09262807fcf2937fe02", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c5 HTTP\/1.1", "port": 8100, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8100 \u00b7 (reconnaissance)", "target_port_label": "8100 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (43 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8100, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c5 HTTP\/1.1", "port": 8100, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8100 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8100 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8100" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 119, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1085, 1086, 1087, 1088, 1089, 1090, 1091 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 119, "scan_velocity_ports_per_s": 75.35, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 43, "multi_protocol_sample": [ "bitcoin", "consul", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi", "jetdirect" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_flood" ] }
20/07/2026 06:55:43 UTC	TCP	8071 · HTTP	http	Scan de ports port scan syn · via HTTP:8071 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8071 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4do HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4do HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4do HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "e27c58b6b5ae275831ee883268c237f22b710f9b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.020037714057217, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8071, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "4ce1791327e739cee4dda0df20047dbad8137e11", "event_fingerprint": "5bd49430ea5046752eb8504b828049acc61f6d54", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "441fc7d855029ab79a43d3a7813e0e6c", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8071, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4do HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4do", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4do HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4do HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4do HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4do", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4do HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4do HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4do HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ab527546d3e021764e6679388e14308e82eff1c6", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4do HTTP\/1.1", "port": 8071, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4do HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8071 \u00b7 (reconnaissance)", "target_port_label": "8071 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (43 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8071, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4do HTTP\/1.1", "port": 8071, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8071 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4do HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8071 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8071" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 120, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1085, 1086, 1087, 1088, 1089, 1090, 1091 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 120, "scan_velocity_ports_per_s": 75.61, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 43, "multi_protocol_sample": [ "bitcoin", "consul", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi", "jetdirect" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_flood" ] }
20/07/2026 06:55:43 UTC	TCP	9001 · TOR OR	tor-or	Scan de ports port scan syn · via TOR OR:9001 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur TOR-OR WAF — Recommandation Surveiller Tags net_flood tor_exit_probe tor_or_emulated tor_or_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9001 Chemin / cible — Service TOR OR Payload GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d1 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d1 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4d1 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "030000000000000000", "emulator_response_len": 9, "bytes_in": 194, "payload_entropy": 5.030151844213243, "port_category": "registered", "org": "TechTies Inc.", "service": "tor-or", "app_proto": "tor-or", "asn": 197170, "country": "NL", "dst_port": 9001, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b52b2c1c7cc6b18e729e195f07cbeb37c54cc0a2", "event_fingerprint": "925ff45fbd00172fd5637e01f1a2163abef9dac3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "tor-or", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "87222a9226e3fc7f8b6f5c093529ea49", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 9001, "service": "tor-or", "service_name": "tor-or", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8f04c175adce3e2abfa0a3213e8f33f40ca93868", "protocol_details": { "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "port": 9001, "service": "tor-or", "service_label_fr": "TOR OR" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via TOR OR:9001 \u00b7 (reconnaissance)", "target_port_label": "9001 \u00b7 TOR OR", "emulator_service": "tor-or", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TOR OR \u2014 multi-protocole (44 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "tor-or", "service_label_fr": "TOR OR", "dst_port": 9001, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tor-or", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "port": 9001, "service": "tor-or", "service_label_fr": "TOR OR" }, "attack_vector": "port scan syn \u00b7 via TOR OR:9001 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d1 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "9001 \u00b7 TOR OR", "emulator_service": "tor-or", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tor_or", "service_banner": "honeypot-tor-or", "service_os": "linux", "dst_port": "9001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 121, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1085, 1086, 1087, 1088, 1089, 1090, 1091 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 121, "scan_velocity_ports_per_s": 76, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 44, "multi_protocol_sample": [ "bitcoin", "consul", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi", "jetdirect" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_flood", "tor_exit_probe", "tor_or_emulated", "tor_or_payload" ] }
20/07/2026 06:55:43 UTC	TCP	9088 · HTTP	http	Scan de ports port scan syn · via HTTP:9088 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9088 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4db HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4db HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4db HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "f84494d1e4841bfca9364ca4397e07b6c6cdb523", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.034557787369292, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 9088, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "d2c98bf08d63f9dc855ef5346670dec60edda630", "event_fingerprint": "1370aff90c20955b56b45d7a1ea9ea25555c7ab9", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "44791d403b1067f38aaa0d05b47b4877", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 9088, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4db HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4db", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4db HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4db HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4db HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4db", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4db HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4db HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4db HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2aee45b1779e9a349264061abfc2848527a7a7ff", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4db HTTP\/1.1", "port": 9088, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4db HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:9088 \u00b7 (reconnaissance)", "target_port_label": "9088 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (44 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9088, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4db HTTP\/1.1", "port": 9088, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9088 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4db HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "9088 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9088" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 121, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1085, 1086, 1087, 1088, 1089, 1090, 1091 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 121, "scan_velocity_ports_per_s": 75.64, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 44, "multi_protocol_sample": [ "bitcoin", "consul", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi", "jetdirect" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_flood" ] }
20/07/2026 06:55:43 UTC	TCP	8042 · HTTP	http	Scan de ports port scan syn · via HTTP:8042 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8042 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cs HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cs HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4cs HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "81b71b46d3460cd631cb8c981bb95383246fa2a1", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 4.99993392782067, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8042, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "0a6013355da4fe39bffdfd1fb2b7bf6657099f92", "event_fingerprint": "71fc8fea6f25515185354d9b91938c9ef415b921", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "96a103cdf92fd2b1f7b65ad89d078e15", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8042, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cs HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4cs", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cs HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cs HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cs HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4cs", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cs HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cs HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cs HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d15b725b331ced4c2a10beadad05766ad53bcb32", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cs HTTP\/1.1", "port": 8042, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cs HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8042 \u00b7 (reconnaissance)", "target_port_label": "8042 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (44 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8042, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cs HTTP\/1.1", "port": 8042, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8042 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cs HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8042 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8042" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 122, "port_scan_ports_sample": [ 81, 82, 83, 84, 88, 999, 1080, 1081, 1082, 1085, 1086, 1087, 1088, 1089, 1090, 1091 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 122, "scan_velocity_ports_per_s": 75.92, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "cloud", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 44, "multi_protocol_sample": [ "bitcoin", "consul", "discord-webhook", "hdfs-namenode", "http", "https", "java-rmi", "jetdirect" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_flood" ] }
20/07/2026 06:55:43 UTC	TCP	6588 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:6588 · (sonde / probe)	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 6588 Chemin / cible / Service HTTP Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 44 · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4b8 HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4b8 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4b8 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "0195d92fb4c3da4feb1db689ac847ca3eb4bcf3b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.0242485090187765, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 6588, "risk_waf": 44, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 44, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "f89d8bf84ceb9f4411d7e35aa8318edc1802455c", "event_fingerprint": "e1fce9cde3f3f84f2f7a17e8eb6b1d91f70c49d8", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8904edd01a1194c417639c145fa33865", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "service_name": "http", "target_context": { "dst_port": 6588, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4b8", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b8 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4b8", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b8 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 77%" }, "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 44, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c4cbf70fce5c8b63ee2f2079fee0838c9fde8d10", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b8 HTTP\/1.1", "port": 6588, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "Sonde HTTP \u00b7 via HTTP:6588 \u00b7 (sonde \/ probe)", "target_port_label": "6588 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 77%", "classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 44, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 6588, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b8 HTTP\/1.1", "port": 6588, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:6588 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "6588 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "6588" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua" ] }
20/07/2026 06:55:43 UTC	TCP	999	—	proxy probe proxy probe · port 999 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags socks5_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 999 Chemin / cible — Payload Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "bytes_in": 3, "payload_entropy": 1.584962500721156, "port_category": "well_known", "org": "TechTies Inc.", "service": null, "app_proto": null, "asn": 197170, "country": "NL", "dst_port": 999, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "ce10e7554571973b0432369d9b8c4624f360620d", "event_fingerprint": "501c22580bbf62cbda2aff2e4e7d73f26235398a", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "da075e9d699084fc189cdd233081c49f", "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3" }, "target_context": { "dst_port": 999, "risk_score": 35 }, "payload_preview": "\u0005\u0001\u0000", "request_sample": "\u0005\u0001\u0000", "payload_snippet": "\u0005\u0001\u0000", "evidence": { "request_sample": "\u0005\u0001\u0000", "payload_snippet": "\u0005\u0001\u0000", "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1075b36284a2a6701e9feb2e2e993605c59171f3", "protocol_details": { "payload_preview": "\u0005\u0001\u0000", "port": 999 }, "attack_vector": "proxy probe \u00b7 port 999 \u00b7 (sonde \/ probe)", "target_port_label": "999", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 999, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0005\u0001\u0000", "port": 999 }, "attack_vector": "proxy probe \u00b7 port 999 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "999", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "999" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "socks5_greeting" ] }
20/07/2026 06:55:43 UTC	TCP	81 · HTTP	http	Scan de ports port scan syn · via HTTP:81 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 81 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +12 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "well_known", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 81, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7f2431da0b2e12d79179a0c89b8240a38b0fbd44", "event_fingerprint": "9246375851aaa9ef21ff1e61bef02639fca3f619", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 12 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 81, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "625ea718d7fa2b1992a2f429995fab490bfea043", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 12 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 81, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +12", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 81, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "81 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +12", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "rapid_port_scan": true, "rapid_scan_distinct_ports": 3, "scan_velocity_ports_per_s": 30, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 12, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 06:55:43 UTC	TCP	3130 · HTTP	http	Scan de ports port scan syn · via HTTP:3130 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3130 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4bb HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4bb HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4bb HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "42d3f8ea01678e34626825f180c94e521c8ca30d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.017830403359825, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 3130, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "67d06cf9937866b47e82a49a5ac4d4f8fba68702", "event_fingerprint": "94a252dfb2f844cf7297ad062cb910504ab076d4", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 231, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b327d25a1b54a100fc66fa3619f5d2ee", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 3130, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4bb", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bb HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4bb", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bb HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3deda44e67580f1b62b61409c0f472bc97b15a11", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bb HTTP\/1.1", "port": 3130, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:3130 \u00b7 (reconnaissance)", "target_port_label": "3130 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3130, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bb HTTP\/1.1", "port": 3130, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:3130 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bb HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "3130 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3130" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 4, "port_scan_ports_sample": [ 81, 999, 3130, 6588 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 4, "scan_velocity_ports_per_s": 40, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua" ] }
20/07/2026 06:55:43 UTC	TCP	8080 · HTTP	http	Scan de ports port scan syn · via HTTP:8080 · (reconnaissance) · → N	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole " N Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_no_ua net_web_probe Cible HTTP " N TLS SNI — Capteur paris-1
Preuve / Evidence Méthode " Port 8080 Chemin / cible N Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake Ligne de requête `" N HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) �" �N Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "e42e8bb820d4f7550a0f04619f4e15fdc56943b9", "http_referer_hash": null, "http_method": "\u0004\u0001\u0001\"", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 9, "payload_entropy": 2.94770277922009, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8080, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "419e4ac29452b92a185dedfa84ffda7030a25df9", "event_fingerprint": "7be00b426727ff2fe98f59ab26f7aa409ec70429", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0554" ], "matched_pattern_names": [ "Minecraft varint handshake" ], "pattern_ids": [ "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f6d7f72f6464e12cbf41f58650886486", "path_pattern_hash": "481daf8515fdae90077119892b048315" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "method": "\u0004\u0001\u0001\"", "path": "N\u0000", "request_line": "\u0004\u0001\u0001\" N\u0000 HTTP\/1.1", "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "evidence": { "method": "\u0004\u0001\u0001\"", "path": "N\u0000", "request_line": "\u0004\u0001\u0001\" N\u0000 HTTP\/1.1", "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4e9a4c5f01f2eddcefea0cc505c268efacb5ed4a", "protocol_details": { "http_method": "\u0004\u0001\u0001\"", "http_path": "N\u0000", "request_line": "\u0004\u0001\u0001\" N\u0000 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "\ufffd\"\r\ufffdN", "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 N\u0000", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "\u0004\u0001\u0001\"", "http_path": "N\u0000", "request_line": "\u0004\u0001\u0001\" N\u0000 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 N\u0000", "evidence_snippet": "\ufffd\"\r\ufffdN", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 5, "port_scan_ports_sample": [ 81, 999, 3130, 6588, 8080 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 5, "scan_velocity_ports_per_s": 50, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_no_ua", "net_web_probe" ] }
20/07/2026 06:55:43 UTC	TCP	8019 · HTTP	http	Scan de ports port scan syn · via HTTP:8019 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8019 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4at HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4at HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4at HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "b4fbfe0caa70502fc559da39b4be53e117b9ffe1", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.002064166112599, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8019, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "64f5ed988f24f9ccf33d3f210a7c7603e205dff3", "event_fingerprint": "eef133788c9986233f6ab37ba574d073798a85ce", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a1742b6a7d0376a7b7002a7562d9d180", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8019, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4at HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4at", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4at HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4at HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4at HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4at", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4at HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4at HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4at HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "47e035dac9cde1847b5bc94098fcdf736ce9a500", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4at HTTP\/1.1", "port": 8019, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4at HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8019 \u00b7 (reconnaissance)", "target_port_label": "8019 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8019, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4at HTTP\/1.1", "port": 8019, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8019 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4at HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8019 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8019" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 6, "port_scan_ports_sample": [ 81, 999, 3130, 6588, 8019, 8080 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 6, "scan_velocity_ports_per_s": 60, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua" ] }
20/07/2026 06:55:43 UTC	TCP	8880 · HTTP	http	Scan de ports port scan syn · via HTTP:8880 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8880 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8880, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "2582f1b497b86a23efeb7041ee2c506f65bb0113", "event_fingerprint": "0aa2fe6fdc39407345fcb9dcae1c6d8543761d73", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a02d261d6fd5ed455386d786753cd32ed8288e63", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8880 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 81, 999, 3130, 6588, 8019, 8080, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 7, "scan_velocity_ports_per_s": 70, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
20/07/2026 06:55:43 UTC	TCP	8019 · HTTP	http	Scan de ports port scan syn · via HTTP:8019 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8019 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8019, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "44086c011e377a1000d66dde04bd55182e85976b", "event_fingerprint": "86e1f62e7f16c6764fdd8181ef759817ca37a52a", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8019, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8d9ba00c971de2d07fe04436d0bf41b2fb171647", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8019, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8019 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8019 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8019, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8019, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8019 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8019 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8019" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 81, 999, 3130, 6588, 8019, 8080, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 7, "scan_velocity_ports_per_s": 70, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
20/07/2026 06:55:43 UTC	TCP	8080 · HTTP	http	Scan de ports port scan syn · via HTTP:8080 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8080 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ad HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ad HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ad HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "87362abc0945cc0cbb53835096c867b05e0684c1", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.025411202261986, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8080, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "039a3142f28dac5d2fbf3edae0f47be4717d469e", "event_fingerprint": "cf512602f44140a9453c536757627eb330ab15c0", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1c0895cf2c28c964e7170fbcb5029fb4", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ad HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4ad", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ad HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ad HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ad HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4ad", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ad HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ad HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ad HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cc825e07ad0bc3312750aba40a1ebd2773449687", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ad HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ad HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance)", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 18 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ad HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ad HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 7, "port_scan_ports_sample": [ 81, 999, 3130, 6588, 8019, 8080, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 7, "scan_velocity_ports_per_s": 70, "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_web_probe" ] }
20/07/2026 06:55:43 UTC	TCP	8333 · BITCOIN	bitcoin	Scan de ports port scan syn · via BITCOIN:8333 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur BITCOIN WAF — Recommandation Surveiller Tags bitcoin_emulated net_bitcoin_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8333 Chemin / cible — Service BITCOIN Payload CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000", "emulator_response_len": 130, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "bitcoin", "app_proto": "bitcoin", "asn": 197170, "country": "NL", "dst_port": 8333, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "83a51cb85e8139c2c8675072eb3c73419b12a039", "event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "bitcoin", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8333, "service": "bitcoin", "service_name": "bitcoin", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8fbaf2818f842cf25613636efcf40829f1f4788e", "protocol_details": { "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "port": 8333, "service": "bitcoin", "service_label_fr": "BITCOIN" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via BITCOIN:8333 \u00b7 (reconnaissance)", "target_port_label": "8333 \u00b7 BITCOIN", "emulator_service": "bitcoin", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via BITCOIN \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "bitcoin", "service_label_fr": "BITCOIN", "dst_port": 8333, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-bitcoin", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "port": 8333, "service": "bitcoin", "service_label_fr": "BITCOIN" }, "attack_vector": "port scan syn \u00b7 via BITCOIN:8333 \u00b7 (reconnaissance)", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8333 \u00b7 BITCOIN", "emulator_service": "bitcoin", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "bitcoin", "service_banner": "honeypot-bitcoin", "service_os": "linux", "dst_port": "8333" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 8, "port_scan_ports_sample": [ 81, 999, 3130, 6588, 8019, 8080, 8333, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 8, "scan_velocity_ports_per_s": 80, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "bitcoin", "http", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "bitcoin_emulated", "net_bitcoin_probe" ] }
20/07/2026 06:55:43 UTC	TCP	8124 · HTTP	http	Scan de ports port scan syn · via HTTP:8124 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8124 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4aj HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4aj HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4aj HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "30e60cee00afeb646e7a7d0f59a655fb284420e1", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.0151019239114705, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8124, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.7, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "8b9813a5f53546eb9f3397889dde8f7d71e26d15", "event_fingerprint": "cadc0a8509ddcb8aa05044eb304c78f1ddc1af74", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c335d795c910ba8a75e1e5e2b7ff386e", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8124, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4aj", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aj HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4aj", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aj HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bfd913203d24c31691435c3405254a7a2bb8113c", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aj HTTP\/1.1", "port": 8124, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8124 \u00b7 (reconnaissance)", "target_port_label": "8124 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8124, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aj HTTP\/1.1", "port": 8124, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8124 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aj HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8124 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8124" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 9, "port_scan_ports_sample": [ 81, 999, 3130, 6588, 8019, 8080, 8124, 8333, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 9, "scan_velocity_ports_per_s": 90, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "bitcoin", "http", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua" ] }
20/07/2026 06:55:43 UTC	TCP	8443 · HTTPS	https	Scan de ports port scan syn · via HTTPS:8443 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8443 Chemin / cible — Service HTTPS Payload GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4aq HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4aq HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4aq HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 194, "payload_entropy": 5.025411202261986, "port_category": "registered", "org": "TechTies Inc.", "service": "https", "app_proto": "https", "asn": 197170, "country": "NL", "dst_port": 8443, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "baa690d1c17ffc3e0bea7942e5e4e6fb74221eb7", "event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f01a44b3fbe2c209376790719b42ca34", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8443, "service": "https", "service_name": "https", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ffab7f0cbc7b404364ac31b8c96ab15743762a4c", "protocol_details": { "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "port": 8443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)", "target_port_label": "8443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 8443, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "port": 8443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4aq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "8443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 10, "port_scan_ports_sample": [ 81, 999, 3130, 6588, 8019, 8080, 8124, 8333, 8443, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 10, "scan_velocity_ports_per_s": 100, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe" ] }
20/07/2026 06:55:43 UTC	TCP	8124 · HTTP	http	Scan de ports port scan syn · via HTTP:8124 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8124 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8124, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "765c8f77d9e9ba1c8bdef733849f4559245751ab", "event_fingerprint": "1d88b94ab18d31e99212e1cfab5ad7723052972d", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8124, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b2073f7f2135b9dc771f51d28a9d39fdc66971f6", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8124, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8124 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8124 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8124, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8124, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8124 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8124 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8124" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 10, "port_scan_ports_sample": [ 81, 999, 3130, 6588, 8019, 8080, 8124, 8333, 8443, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 10, "scan_velocity_ports_per_s": 100, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
20/07/2026 06:55:43 UTC	TCP	8029 · HTTP	http	Scan de ports port scan syn · via HTTP:8029 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8029 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8029, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d9db4c94efa0b462deaaaefb57c2511dd411aaad", "event_fingerprint": "fe81d4d34ee6a0bc41b9fbaf7d7c7fcec9f73e0e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 293, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8029, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1fb81191413a64e7d61099734fab8fe4f66d330c", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8029, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8029 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8029 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8029, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8029, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8029 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8029 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8029" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 11, "port_scan_ports_sample": [ 81, 999, 3130, 6588, 8019, 8029, 8080, 8124, 8333, 8443, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 11, "scan_velocity_ports_per_s": 110, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "behavior_alert_count": 1, "behavior_priority": 84 }
20/07/2026 06:55:43 UTC	TCP	83 · HTTP	http	Scan de ports port scan syn · via HTTP:83 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 83 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ba HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ba HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4ba HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "f96d63a457489f24b52f8bd1e16f6b2046df6ffe", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.011210751219906, "port_category": "well_known", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 83, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "90d72e4f4751b37396510ba2a0107b90aea2efa4", "event_fingerprint": "e8af69653c148d2b88eeaf683d47b2f9192f4856", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b0a587f8806558f65d3ac818520167f7", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 83, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ba HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4ba", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ba HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ba HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ba HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4ba", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ba HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ba HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ba HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b2d5208644ab73b87fb223a364dd147440b19979", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ba HTTP\/1.1", "port": 83, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ba HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:83 \u00b7 (reconnaissance)", "target_port_label": "83 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 83, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ba HTTP\/1.1", "port": 83, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:83 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4ba HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "83 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "83" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 12, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8019, 8029, 8080, 8124, 8333, 8443, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 12, "scan_velocity_ports_per_s": 120, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8011 · HTTP	http	Scan de ports port scan syn · via HTTP:8011 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_port_scan_fast Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8011 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8011, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "9c5d16ae367f766ea95bdf8112029651f2bfe4b6", "event_fingerprint": "5a3c6fe62733a78a3a3aed5c5794dd9d9b963ba8", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8011, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "12e480a4c0da7d8ca5fbca060234cec4908155bc", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8011, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8011 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8011 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8011, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8011, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8011 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8011 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8011" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 13, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8011, 8019, 8029, 8080, 8124, 8333, 8443, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 13, "scan_velocity_ports_per_s": 124.41, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8095 · HTTP	http	Scan de ports port scan syn · via HTTP:8095 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_port_scan_fast Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8095 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8095, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "dcb3775bc95012845eca1a76c52c68535b67bf9c", "event_fingerprint": "228f894a254848ec0c20bf56b09ffc96bbbb26fa", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8095, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "799d3a2a6abe05a0cfa577d8bdd15989bc139dbf", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8095, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8095 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8095 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8095, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8095, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8095 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8095 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8095" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 14, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8011, 8019, 8029, 8080, 8095, 8124, 8333, 8443, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 14, "scan_velocity_ports_per_s": 128.41, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8005 · HTTP	http	Scan de ports port scan syn · via HTTP:8005 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_port_scan_fast Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8005 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8005, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "36c0da7ca944ba0f05e9e9f1038f57bdc505ed56", "event_fingerprint": "a3e2a65f9c226e19ea976c9634d2e6ce52dd7952", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8005, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f3269550370f088f8a738d555a998edf71fbbaa7", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8005 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8005, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8005 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 15, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8019, 8029, 8080, 8095, 8124, 8333, 8443, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 15, "scan_velocity_ports_per_s": 132.29, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8200 · HTTP	http	Scan de ports port scan syn · via HTTP:8200 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8200 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4b7 HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4b7 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4b7 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "9d26b488bf81f73b2a17a06cbeabbf0057dea7f0", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.034557787369292, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8200, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "cac0d4a75ea0186dee715b524ab45f30a17ea27f", "event_fingerprint": "52b45dec31f06aa4e59152bae4733da5908a8709", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "777e8badb3973237494a7dac5bba84f3", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8200, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b7 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4b7", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b7 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b7 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b7 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4b7", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b7 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b7 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b7 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "400c1b2fa3ff46dd3279446f4991cd0465af5830", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b7 HTTP\/1.1", "port": 8200, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b7 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8200 \u00b7 (reconnaissance)", "target_port_label": "8200 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8200, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b7 HTTP\/1.1", "port": 8200, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8200 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b7 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8200 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8200" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 16, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8019, 8029, 8080, 8095, 8124, 8200, 8333, 8443, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 16, "scan_velocity_ports_per_s": 133.08, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	3130 · HTTP	http	Scan de ports port scan syn · via HTTP:3130 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_port_scan_fast Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3130 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 3130, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "fc1a27e9fcee513e2cb1f38a10f55681e792a170", "event_fingerprint": "1f5579e37cfc5561a0c84cabe6fb076b145fc673", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 3130, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "15c227ef3397424fae839e5c1131231686196e73", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 3130, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:3130 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "3130 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3130, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 3130, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:3130 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "3130 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3130" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 16, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8019, 8029, 8080, 8095, 8124, 8200, 8333, 8443, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 16, "scan_velocity_ports_per_s": 128.36, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8443 · HTTPS	https	Scan de ports port scan syn · via HTTPS:8443 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_port_scan_fast Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8443 Chemin / cible — Service HTTPS Payload CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "https", "app_proto": "https", "asn": 197170, "country": "NL", "dst_port": 8443, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "9acc5b3bdfe39add3f9ff589870febf3438dd603", "event_fingerprint": "ebbf50493a5cd01037444d3e811aea60318e67dd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8443, "service": "https", "service_name": "https", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5302b6186e3c0f62d6590c6fe441eceecd39c236", "protocol_details": { "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "port": 8443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)", "target_port_label": "8443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 8443, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "port": 8443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "8443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 16, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8019, 8029, 8080, 8095, 8124, 8200, 8333, 8443, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 16, "scan_velocity_ports_per_s": 125.28, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8080 · HTTP	http	Scan de ports port scan syn · via HTTP:8080 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_port_scan_fast Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8080, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b7b1c73b1e1f32f73596273e8b3767d92a3b5980", "event_fingerprint": "c8d8591e9141f5c0db2c5989f0dd4e0399d6c790", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6bb66238f954904f635d28d2ca43d10c5e90fc72", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 16, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8019, 8029, 8080, 8095, 8124, 8200, 8333, 8443, 8880 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 16, "scan_velocity_ports_per_s": 121.18, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8400 · HTTP	http	Scan de ports port scan syn · via HTTP:8400 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_port_scan_fast Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8400 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "bfafa553c62e3d325850344bc5560e64b6f7a7f8", "event_fingerprint": "d921623fcbfcd933ce7014066375667c7fee6105", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8400, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c5e56b856f3a4277f7e1c4c1cf7117990b8f5b1d", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8400 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8400, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8400 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 17, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8019, 8029, 8080, 8095, 8124, 8200, 8333, 8400, 8443 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 17, "scan_velocity_ports_per_s": 124.7, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8092 · HTTP	http	Scan de ports port scan syn · via HTTP:8092 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8092 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4b0 HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4b0 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4b0 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "50f9696d52232f805c117f468b9795933301316d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.0242485090187765, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8092, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "5ba369a1203ea0dba593446233710d2b377930bd", "event_fingerprint": "cb3735434c899aff27942d62c0a9640ae59aaac2", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "732383ed31e824ba1db627f0538a8e46", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8092, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b0 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4b0", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b0 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b0 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b0 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4b0", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b0 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b0 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b0 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2e8cbb0865a9a2a038010917f4db0e381e688657", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b0 HTTP\/1.1", "port": 8092, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b0 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8092 \u00b7 (reconnaissance)", "target_port_label": "8092 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8092, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b0 HTTP\/1.1", "port": 8092, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8092 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b0 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8092 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8092" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 18, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8019, 8029, 8080, 8092, 8095, 8124, 8200, 8333, 8400 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 18, "scan_velocity_ports_per_s": 125.62, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8015 · HTTP	http	Scan de ports port scan syn · via HTTP:8015 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_port_scan_fast Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8015 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8015, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "957ed02868c3845325c489229463149686a7cf6c", "event_fingerprint": "fea866c273c89a32581daa4c8b109f6dad27cd20", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8015, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3c375320b1650bbeab06ced0663df9f106dbe425", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8015, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8015 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8015 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8015, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8015, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8015 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8015 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8015" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 19, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8029, 8080, 8092, 8095, 8124, 8200, 8333 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 19, "scan_velocity_ports_per_s": 128.61, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8028 · HTTP	http	Scan de ports port scan syn · via HTTP:8028 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_port_scan_fast Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8028 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8028, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "11d5254febaca271a7627094cf72d49db717c308", "event_fingerprint": "80de4b46da1058bd949449c3f2a7f8dad7a89ad0", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8028, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c0afa99040c7254a86f1c262a14fc59430a3d508", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8028, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8028 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8028 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8028, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8028, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8028 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8028 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8028" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 20, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8028, 8029, 8080, 8092, 8095, 8124, 8200 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 20, "scan_velocity_ports_per_s": 89.9, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	999	—	Scan de ports port scan syn · port 999 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole WAF — Recommandation Surveiller Tags net_port_scan_fast socks4_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 999 Chemin / cible — Payload �" �N Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 User-Agent — Règles WAF — Payload (extrait) �" �N Meta JSON brut { "bytes_in": 9, "payload_entropy": 2.94770277922009, "port_category": "well_known", "org": "TechTies Inc.", "service": null, "app_proto": null, "asn": 197170, "country": "NL", "dst_port": 999, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 8, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 8, "novelty": 0 }, "risk_score": 42, "tag_count": 2, "anomaly_count": 0, "campaign_key": "04338a77643d7653ed3bdf0c731928cd4b98012a", "event_fingerprint": "832f7b65fbb1aa230d591d6b70cd0ed908508c3b", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f6d7f72f6464e12cbf41f58650886486", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 999, "risk_score": 42 }, "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "evidence": { "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a28b2397a8be30bef727bb771353719ec6cbd583", "protocol_details": { "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "port": 999 }, "evidence_snippet": "\ufffd\"\r\ufffdN", "attack_vector": "port scan syn \u00b7 port 999 \u00b7 (reconnaissance)", "target_port_label": "999", "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 8, "novelty": 0, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 999, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000", "port": 999 }, "attack_vector": "port scan syn \u00b7 port 999 \u00b7 (reconnaissance)", "evidence_snippet": "\ufffd\"\r\ufffdN", "target_port_label": "999", "emulator_service": null, "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "999" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 20, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8028, 8029, 8080, 8092, 8095, 8124, 8200 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 20, "scan_velocity_ports_per_s": 89.05, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast", "socks4_greeting" ] }
20/07/2026 06:55:43 UTC	TCP	8080 · HTTP	http	Scan de ports port scan syn · via HTTP:8080 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_no_ua net_port_scan_fast Cible HTTP / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode Port 8080 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) SOCKS5 greeting Ligne de requête `/ HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "\u0005\u0001\u0000", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 3, "payload_entropy": 1.584962500721156, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8080, "risk_waf": 20, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1952973b298753bacd8311ca7b61685d03229984", "event_fingerprint": "1a73e52fcb0af206bdd873fdc276f059b19b837a", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0567" ], "matched_pattern_names": [ "SOCKS5 greeting" ], "pattern_ids": [ "pat-0567" ], "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "da075e9d699084fc189cdd233081c49f", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "\u0005\u0001\u0000", "method": "\u0005\u0001\u0000", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1", "request_sample": "\u0005\u0001\u0000", "payload_snippet": "\u0005\u0001\u0000", "evidence": { "method": "\u0005\u0001\u0000", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1", "request_sample": "\u0005\u0001\u0000", "payload_snippet": "\u0005\u0001\u0000", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9deea9755296660da79aea694c755254f8c4645b", "protocol_details": { "http_method": "\u0005\u0001\u0000", "http_path": "\/", "request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance)", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 20, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "\u0005\u0001\u0000", "http_path": "\/", "request_line": "\u0005\u0001\u0000 \/ HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +23 \u00b7 1 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 20, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8028, 8029, 8080, 8092, 8095, 8124, 8200 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 20, "scan_velocity_ports_per_s": 87.81, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8011 · HTTP	http	Scan de ports port scan syn · via HTTP:8011 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8011 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4az HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4az HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4az HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "2b80305538aac1c7b6e6430f4d7462055329220c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.025411202261986, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8011, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "80dbc16ce3a8792888e73d090968fb9fe6832639", "event_fingerprint": "d2a4438a6bd0dd9df06ce62f9b0d2baa6c5830d1", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fff8927486918246eb403c5df49bda03", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8011, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4az HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4az", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4az HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4az HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4az HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4az", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4az HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4az HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4az HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9548aeb610c48c2bec9250d0af4682a1f828b2bc", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4az HTTP\/1.1", "port": 8011, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4az HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8011 \u00b7 (reconnaissance)", "target_port_label": "8011 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8011, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4az HTTP\/1.1", "port": 8011, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8011 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4az HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8011 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8011" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 20, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8028, 8029, 8080, 8092, 8095, 8124, 8200 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 20, "scan_velocity_ports_per_s": 85.14, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8866 · HTTP	http	Scan de ports port scan syn · via HTTP:8866 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8866 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4av HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4av HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4av HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "ec47cc000a8636f05cdb439758f6affde68a48f4", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.025411202261986, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8866, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "2eac73f3b278d85a33d7fc78923e0759e3ec753f", "event_fingerprint": "4ff245401d598a9d3171838ee368c030415b97ef", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3bb5f4fe9f1e3e73d4cfe5a882ea7b8d", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8866, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4av HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4av", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4av HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4av HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4av HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4av", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4av HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4av HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4av HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ac898ba3cb9008a6d1c4642e8aabcfd9ac56044d", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4av HTTP\/1.1", "port": 8866, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4av HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8866 \u00b7 (reconnaissance)", "target_port_label": "8866 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8866, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4av HTTP\/1.1", "port": 8866, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8866 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4av HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8866 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8866" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 21, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8028, 8029, 8080, 8092, 8095, 8124, 8200 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 21, "scan_velocity_ports_per_s": 86.35, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8005 · HTTP	http	Scan de ports port scan syn · via HTTP:8005 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8005 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4b4 HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4b4 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4b4 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "6ed5a2077bd9509b962a2986a487148d28af2acc", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.020357336327212, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8005, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9d48c138ce8aea9e738f6907062de4724bf0db81", "event_fingerprint": "f78cf3e915e0ca87f7906c763809d87b4188a968", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c28f22fd02ef61cdd6694c9f1c4d4d92", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8005, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4b4", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b4 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4b4", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b4 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c38292f5db722d1d363b4b17e09cdf0e7ba5a9a7", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b4 HTTP\/1.1", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8005 \u00b7 (reconnaissance)", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8005, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b4 HTTP\/1.1", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8005 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b4 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 21, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8028, 8029, 8080, 8092, 8095, 8124, 8200 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 21, "scan_velocity_ports_per_s": 83.82, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8877 · HTTP	http	Scan de ports port scan syn · via HTTP:8877 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_port_scan_fast Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8877 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8877, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "56f174b67fa1d7fd93fe13326a5c80e6e8dee7e0", "event_fingerprint": "57e16ace2c421e36c6a95da212616b7cdccde94f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8877, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3723838470ebaf3f5a2cec475b5c4b0700363828", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8877, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8877 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8877 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8877, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8877, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8877 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8877 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8877" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 22, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8028, 8029, 8080, 8092, 8095, 8124, 8200 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 22, "scan_velocity_ports_per_s": 86.22, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8130 · HTTP	http	Scan de ports port scan syn · via HTTP:8130 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8130 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4bq HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4bq HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4bq HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "4702bce8752ac28c282a564d904b3537ed290ea7", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.034557787369292, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8130, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "63e96c890ac83970f0cdeb022c23434a869b7c75", "event_fingerprint": "734d50606416489b1dabfd7168afc1466582019f", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bba1902a33c85252b12f924ec5a9921f", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8130, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4bq", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bq HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4bq", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bq HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c250e42da4678a8307167bc65c42b9292bdb1b1a", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bq HTTP\/1.1", "port": 8130, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8130 \u00b7 (reconnaissance)", "target_port_label": "8130 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8130, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bq HTTP\/1.1", "port": 8130, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8130 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bq HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8130 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8130" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 23, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8028, 8029, 8080, 8092, 8095, 8124, 8130 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 23, "scan_velocity_ports_per_s": 87.75, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8081 · HTTP	http	Scan de ports port scan syn · via HTTP:8081 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_port_scan_fast Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8081 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8081, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cbbb3d4c049d1c1d83b325939e2c30f4364242a4", "event_fingerprint": "e8e6181ce4a95d9b8ac470fb2daabdb283bac821", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8081, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a066d667436dce3b097a812945dc0a44e64e5e6c", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8081, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8081" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 24, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8028, 8029, 8080, 8081, 8092, 8095, 8124 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 24, "scan_velocity_ports_per_s": 90.04, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8443 · HTTPS	https	Scan de ports port scan syn · via HTTPS:8443 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_port_scan_fast socks5_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8443 Chemin / cible — Service HTTPS Payload Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) Minecraft varint handshake SOCKS5 greeting User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 3, "payload_entropy": 1.584962500721156, "port_category": "registered", "org": "TechTies Inc.", "service": "https", "app_proto": "https", "asn": 197170, "country": "NL", "dst_port": 8443, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 0 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "b834661bef8c6b1e12ba72c0636a3e5f81884b1d", "event_fingerprint": "ebbf50493a5cd01037444d3e811aea60318e67dd", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0554", "pat-0567" ], "matched_pattern_names": [ "Minecraft varint handshake", "SOCKS5 greeting" ], "pattern_ids": [ "pat-0554", "pat-0567" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 0, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "da075e9d699084fc189cdd233081c49f", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8443, "service": "https", "service_name": "https", "risk_score": 42 }, "payload_preview": "\u0005\u0001\u0000", "request_sample": "\u0005\u0001\u0000", "payload_snippet": "\u0005\u0001\u0000", "evidence": { "request_sample": "\u0005\u0001\u0000", "payload_snippet": "\u0005\u0001\u0000", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0bdb87666744dc737bcdada9d84ce607337e7fbd", "protocol_details": { "payload_preview": "\u0005\u0001\u0000", "port": 8443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)", "target_port_label": "8443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 0, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 8443, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "payload_preview": "\u0005\u0001\u0000", "port": 8443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)", "evidence_snippet": null, "target_port_label": "8443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "8443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 24, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8028, 8029, 8080, 8081, 8092, 8095, 8124 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 24, "scan_velocity_ports_per_s": 89.44, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_port_scan_fast", "socks5_greeting" ] }
20/07/2026 06:55:43 UTC	TCP	8123 · HTTP	http	Scan de ports port scan syn · via HTTP:8123 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_port_scan_fast Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8123 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8123, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "41c749402d9940b025e48b6fe348672d6cb6cd42", "event_fingerprint": "96d8cc15d2e95c0e18411c34f1be491d19cc6939", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7cba9ce5ddc0db8a845c76f69248fe21064376f9", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8123 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8123 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8028, 8029, 8080, 8081, 8092, 8095, 8123 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 25, "scan_velocity_ports_per_s": 91.64, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8123 · HTTP	http	Scan de ports port scan syn · via HTTP:8123 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8123 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4b2 HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4b2 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4b2 HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "ee110ae1a9ed6350bde61ebeb68abb36e232fe6d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.020357336327212, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8123, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "19ee0ee9471641b9b4cc804f1038d180897ac295", "event_fingerprint": "7d9dd052ef52edebebffa384c1bb6585e4e8fe85", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "60cb078e7bf076b2668a3c56e47e0326", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8123, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4b2", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b2 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4b2", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b2 HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "519b82675d21d88a17f8fbeb32083d70f622c7a0", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b2 HTTP\/1.1", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8123 \u00b7 (reconnaissance)", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8123, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b2 HTTP\/1.1", "port": 8123, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8123 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4b2 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8123 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 25, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8028, 8029, 8080, 8081, 8092, 8095, 8123 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 25, "scan_velocity_ports_per_s": 89.29, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 4, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8025 · SMTP ALT2	smtp-alt2	Scan de ports port scan syn · via SMTP ALT2:8025 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole Émulateur SMTP-ALT2 WAF — Recommandation Surveiller Tags net_port_scan_fast Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8025 Chemin / cible — Service SMTP ALT2 Payload CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f7420736d74705f616c743220726561647920706f72743d383032350d0a", "emulator_response_len": 40, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "smtp-alt2", "app_proto": "smtp-alt2", "asn": 197170, "country": "NL", "dst_port": 8025, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 42, "tag_count": 1, "anomaly_count": 0, "campaign_key": "c04e3dfd31cff6704e3d2b6f97b459a77b85d28d", "event_fingerprint": "fa289a3f8aeb5012aae496ee3af08752d71daf38", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "smtp-alt2", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9" }, "target_context": { "dst_port": 8025, "service": "smtp-alt2", "service_name": "smtp-alt2", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a41c3b1cec7fb6c1e85fb29fc1dcae8c5ea4a16f", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "port": 8025, "service": "smtp-alt2", "service_label_fr": "SMTP ALT2" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via SMTP ALT2:8025 \u00b7 (reconnaissance)", "target_port_label": "8025 \u00b7 SMTP ALT2", "emulator_service": "smtp-alt2", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SMTP ALT2 \u2014 multi-protocole (5 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "smtp-alt2", "service_label_fr": "SMTP ALT2", "dst_port": 8025, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-smtp-alt2", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "port": 8025, "service": "smtp-alt2", "service_label_fr": "SMTP ALT2" }, "attack_vector": "port scan syn \u00b7 via SMTP ALT2:8025 \u00b7 (reconnaissance)", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8025 \u00b7 SMTP ALT2", "emulator_service": "smtp-alt2", "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "smtp_alt2", "service_banner": "honeypot-smtp-alt2", "service_os": "linux", "dst_port": "8025" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 26, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8025, 8028, 8029, 8080, 8081, 8092, 8095 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 26, "scan_velocity_ports_per_s": 91.85, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 5, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999", "smtp-alt2" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8041 · HTTP	http	Scan de ports port scan syn · via HTTP:8041 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_port_scan_fast Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8041 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8041, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "a44fbbf9da1b0a09471920fd4f920f503abb54e2", "event_fingerprint": "87ff282d5cd768838f27255108937e04164907f9", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8041, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fb810071a64ffd8bec52aa1bf689a728cf629416", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8041, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8041 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8041 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (5 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8041, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8041, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8041 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8041 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8041" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 27, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8025, 8028, 8029, 8041, 8080, 8081, 8092 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 27, "scan_velocity_ports_per_s": 93.93, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 5, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999", "smtp-alt2" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8027 · HTTP	http	Scan de ports port scan syn · via HTTP:8027 · (reconnaissance)	Élevée	Moyen · 43
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8027 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 43 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4bu HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4bu HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4bu HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "a3f8f8cedbdf24b4584f703cae805c6ac41451c4", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.034557787369292, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8027, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 43, "tag_count": 5, "anomaly_count": 0, "campaign_key": "43688fc2b54768627a314eea8714009ed3c1033a", "event_fingerprint": "9627b105da4daee28751e9e99b64cbb68836c8b8", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 43, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "01b232ae7789a700bf13c172da245bf0", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8027, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bu HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4bu", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bu HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bu HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bu HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4bu", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bu HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bu HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bu HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f970f892d6a6dd1b63da7e3ce9d1b3b783cd7564", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bu HTTP\/1.1", "port": 8027, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bu HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8027 \u00b7 (reconnaissance)", "target_port_label": "8027 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (5 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 43, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8027, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bu HTTP\/1.1", "port": 8027, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8027 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bu HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8027 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8027" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 28, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8025, 8027, 8028, 8029, 8041, 8080, 8081 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 28, "scan_velocity_ports_per_s": 95.13, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 5, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999", "smtp-alt2" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8877 · HTTP	http	Scan de ports port scan syn · via HTTP:8877 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole GET / Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path http_absolute_uri http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8877 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, sap-sapcontrol-path · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4bf HTTP/1.1` User-Agent — Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4bf HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Requête brute (extrait) GET http://check.proxypool.sh/?pc_probe=9fcc4fea20118932-bet4bf HTTP/1.1 Host: check.proxypool.sh Accept: application/json,/ Cache-Control: no-cache Pragma: no-cache Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 1, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195", "http_target_hash": "5c42572a258729d9c30a67aff44b65263d5ae99d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 194, "payload_entropy": 5.020357336327211, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8877, "risk_waf": 44, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "48a50a46fc46d7ab5b961fd9fc352a19a8ffb80f", "event_fingerprint": "84e60d44c607accc64908eedf52f073d1b052611", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e56f7f6b179298c9133c3a54d2e1c9b2", "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469" }, "target_context": { "dst_port": 8877, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bf HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4bf", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bf HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bf HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bf HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "evidence": { "method": "GET", "path": "\/", "query_string": "pc_probe=9fcc4fea20118932-bet4bf", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bf HTTP\/1.1", "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bf HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bf HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "85fda43e3f9c345018aa699fa143eb6d041b78f4", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bf HTTP\/1.1", "port": 8877, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bf HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "attack_vector": "port scan syn \u00b7 via HTTP:8877 \u00b7 (reconnaissance)", "target_port_label": "8877 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (5 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 44, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8877, "protocol_emulated": null, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bf HTTP\/1.1", "port": 8877, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8877 \u00b7 (reconnaissance)", "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bf HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,\/", "target_port_label": "8877 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8877" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 28, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8025, 8027, 8028, 8029, 8041, 8080, 8081 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 28, "scan_velocity_ports_per_s": 92.94, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 5, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999", "smtp-alt2" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "http_absolute_uri", "http_no_ua", "net_port_scan_fast" ] }
20/07/2026 06:55:43 UTC	TCP	8888 · HTTP	http	Scan de ports port scan syn · via HTTP:8888 · (reconnaissance) · → check.proxypool.sh:443	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 TA0043 Protocole CONNECT check.proxypool.sh:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_port_scan_fast Cible HTTP CONNECT check.proxypool.sh:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8888 Chemin / cible check.proxypool.sh:443 Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE TA0043 Motifs de détection (base) HTTP alt 8888 probe Ligne de requête `CONNECT check.proxypool.sh:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT check.proxypool.sh:443 HTTP/1.1 Host: check.proxypool.sh:443 Proxy-Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 98, "payload_entropy": 4.732491723718083, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8888, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "f02b419b49661e4a6f508833a5ae638e75c8c77e", "event_fingerprint": "bc66c57176ac45742c4c711b09baf3a0b13f6478", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 318, "precision_signals": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "kb_rule_ids": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s", "INT-upstream" ], "matched_patterns": [ "pat-0599" ], "matched_pattern_names": [ "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0599" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25", "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "evidence": { "method": "CONNECT", "path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n", "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4c34c1ac65fd648ecf73f250919b26e86f3e7dc0", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (5 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 42, "correlation_boost": 23 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "MITRE-T1046", "SIGMA-net-port-scan", "INT-beh-scan-burst", "INT-beh-multi-port-60s" ], "tags_summary_labels_fr": [ "MITRE-T1046", "SIGMA-net-port-scan", "Beh Scan Burst", "Beh Multi Port 60S" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_rapide", "campagne_ports", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan rapide multi-ports", "Campagne multi-ports", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +23", "protocol_details": { "http_method": "CONNECT", "http_path": "check.proxypool.sh:443", "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:8888 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443", "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23", "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "port_scan_campaign": true, "port_scan_distinct_ports": 29, "port_scan_ports_sample": [ 81, 83, 999, 3130, 6588, 8005, 8011, 8015, 8019, 8025, 8027, 8028, 8029, 8041, 8080, 8081 ], "rapid_port_scan": true, "rapid_scan_distinct_ports": 29, "scan_velocity_ports_per_s": 94.84, "multi_category_scan": true, "scan_category_diversity": [ "blockchain", "web" ], "multi_protocol_correlation": true, "multi_protocol_count": 5, "multi_protocol_sample": [ "bitcoin", "http", "https", "port:999", "smtp-alt2" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "port_scan_campaign", "rapid_port_scan", "multi_category_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 23, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_port_scan_fast" ] }

45.153.34.89

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence