Détails IP 45.156.128.53

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « port_probe » (signaux protocolaires) · confiance 50%

Confiance 50 % — Score WAF 8

Comparaison ASN / FAI

ASN 211680 · 45.156.128.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 7 événements sur la période pour cette IP.

45.156.129.75 Sonde port 20/07/2026 19:31 UTC
45.156.129.76 Sonde port 20/07/2026 19:31 UTC
45.156.129.164 Sonde port 20/07/2026 18:50 UTC
45.156.129.82 Sonde HTTP 20/07/2026 14:52 UTC
45.156.129.80 Sonde HTTP 20/07/2026 14:52 UTC
45.156.128.56 cpanel probe 20/07/2026 13:54 UTC
45.156.129.98 Sonde HTTP 20/07/2026 13:52 UTC
45.156.129.96 Sonde HTTP 20/07/2026 13:52 UTC

IPs apparentées

Même FAI Sistemas Informaticos, S.A. — corrélation indicative.

45.156.129.75 Sonde port
45.156.129.76 Sonde port
45.156.129.164 Sonde port
45.156.129.82 Sonde HTTP
45.156.129.80 Sonde HTTP

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

GAME UNREAL TCP 3 I2P ROUTER TCP 2 ELASTICSEARCH TRANSPORT ALT TCP 1

GAME UNREAL

3

I2P ROUTER

2

ELASTICSEARCH TRANSPORT ALT

1

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

7 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
19/07/2026 19:59:15 UTC	TCP	11740	—	Sonde port Sonde port · port 11740 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 11740 Chemin / cible — Payload �$��3-�>2!� Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0532 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �$��3-�>2!� Meta JSON brut { "bytes_in": 36, "payload_entropy": 3.0294069451655994, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": null, "app_proto": null, "asn": 211680, "country": "PT", "dst_port": 11740, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "dca2a8c88388d91903678c42af763d5037d01584", "event_fingerprint": "66556d9c240952bf2e9ec0cfd8f4a3a885e4de4f", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0532" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "52d96ed79780da54617533b85b9d0925", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 11740, "risk_score": 44 }, "payload_preview": "\u0000\u0001\u0017\ufffd$\u0000\u0000\u0000\ufffd\ufffd\ufffd\u0003\u00003-\ufffd>\u00032!\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\ufffd\u0000\u0004\u0000\u0000\u0000\u0000", "request_sample": "\u0000\u0001\u0017\ufffd$\u0000\u0000\u0000\ufffd\ufffd\ufffd\u0003\u00003-\ufffd>\u00032!\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\ufffd\u0000\u0004\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0001\u0017\ufffd$\u0000\u0000\u0000\ufffd\ufffd\ufffd\u0003\u00003-\ufffd>\u00032!\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\ufffd\u0000\u0004\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0000\u0001\u0017\ufffd$\u0000\u0000\u0000\ufffd\ufffd\ufffd\u0003\u00003-\ufffd>\u00032!\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\ufffd\u0000\u0004\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0001\u0017\ufffd$\u0000\u0000\u0000\ufffd\ufffd\ufffd\u0003\u00003-\ufffd>\u00032!\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\ufffd\u0000\u0004\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "59422995975fb9b9dca5a45ba2fc08aaaeaf385b", "protocol_details": { "payload_preview": "\u0000\u0001\u0017\ufffd$\u0000\u0000\u0000\ufffd\ufffd\ufffd\u0003\u00003-\ufffd>\u00032!\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\ufffd\u0000\u0004\u0000\u0000\u0000\u0000", "port": 11740 }, "evidence_snippet": "\ufffd$\ufffd\ufffd\ufffd3-\ufffd>2!\ufffd", "attack_vector": "Sonde port \u00b7 port 11740 \u00b7 (sonde \/ probe)", "target_port_label": "11740", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 11740, "protocol_emulated": null, "tags_summary": [ "pat-0532" ], "tags_summary_labels_fr": [ "pat-0532" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0000\u0001\u0017\ufffd$\u0000\u0000\u0000\ufffd\ufffd\ufffd\u0003\u00003-\ufffd>\u00032!\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\ufffd\u0000\u0004\u0000\u0000\u0000\u0000", "port": 11740 }, "attack_vector": "Sonde port \u00b7 port 11740 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd$\ufffd\ufffd\ufffd3-\ufffd>2!\ufffd", "target_port_label": "11740", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "11740" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
18/07/2026 18:20:10 UTC	TCP	9306 · ELASTICSEARCH TRANSPORT ALT	elasticsearch-transport-alt	Sonde SSH Sonde SSH · via ELASTICSEARCH TRANSPORT ALT:9306 · (sonde / probe)	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE T1046 TA0007 TA0001 Protocole Émulateur ELASTICSEARCH-TRANSPORT-ALT WAF — Recommandation Surveiller Tags net_ssh_probe ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9306 Chemin / cible — Service ELASTICSEARCH TRANSPORT ALT Payload SSH-2.0-Go Pourquoi cette classification : Bannière client SSH reçue · confiance 95% Confiance classification 100% Corrélation +10 Risque capteur Moyen · 48 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-Go Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f7420656c61737469637365617263685f7472616e73706f72745f20726561647920706f72743d393330360d0a", "emulator_response_len": 55, "bytes_in": 12, "payload_entropy": 3.2516291673878226, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "elasticsearch-transport-alt", "app_proto": "elasticsearch-transport-alt", "asn": 211680, "country": "PT", "dst_port": 9306, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 48, "tag_count": 2, "anomaly_count": 0, "campaign_key": "8b4d1b8ac6538aabe959d99a818920bf7114890c", "event_fingerprint": "90bd1ae7bafcadbe51886c41179c3c379002439b", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 83, "precision_signals": [ "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0391" ], "matched_pattern_names": [ "SSH-2.0 banner RFC4253" ], "pattern_ids": [ "pat-0391" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 48, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "elasticsearch-transport-alt", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 9306, "service": "elasticsearch-transport-alt", "service_name": "elasticsearch-transport-alt", "risk_score": 48 }, "payload_preview": "SSH-2.0-Go\r\n", "request_sample": "SSH-2.0-Go\r\n", "payload_snippet": "SSH-2.0-Go", "evidence": { "request_sample": "SSH-2.0-Go\r\n", "payload_snippet": "SSH-2.0-Go", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d80ef77aa28cd39520845fffd01cca5fe4733ff9", "protocol_details": { "payload_preview": "SSH-2.0-Go", "port": 9306, "service": "elasticsearch-transport-alt", "service_label_fr": "ELASTICSEARCH TRANSPORT ALT" }, "evidence_snippet": "SSH-2.0-Go", "attack_vector": "Sonde SSH \u00b7 via ELASTICSEARCH TRANSPORT ALT:9306 \u00b7 (sonde \/ probe)", "target_port_label": "9306 \u00b7 ELASTICSEARCH TRANSPORT ALT", "emulator_service": "elasticsearch-transport-alt", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 48, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 48, "risk_label": "Moyen", "service_name": "elasticsearch-transport-alt", "service_label_fr": "ELASTICSEARCH TRANSPORT ALT", "dst_port": 9306, "protocol_emulated": true, "tags_summary": [ "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0391", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-elasticsearch-transport-alt", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "SSH-2.0-Go", "port": 9306, "service": "elasticsearch-transport-alt", "service_label_fr": "ELASTICSEARCH TRANSPORT ALT" }, "attack_vector": "Sonde SSH \u00b7 via ELASTICSEARCH TRANSPORT ALT:9306 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-Go", "target_port_label": "9306 \u00b7 ELASTICSEARCH TRANSPORT ALT", "emulator_service": "elasticsearch-transport-alt", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.128.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "elasticsearch_transport_alt", "service_banner": "honeypot-elasticsearch-transport-alt", "service_os": "linux", "dst_port": "9306" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "45.156.128.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_ssh_probe", "ssh_banner" ] }
15/07/2026 06:02:35 UTC	TCP	7657 · I2P ROUTER	i2p-router	Sonde I2P i2p probe · via I2P ROUTER:7657 · (sonde / probe)	Élevée	Faible · 24
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur I2P-ROUTER WAF — Recommandation Surveiller Tags i2p_router_emulated net_i2p_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7657 Chemin / cible — Service I2P ROUTER Pourquoi cette classification : Type « i2p_probe » (signaux protocolaires) · confiance 0% Confiance classification 10% Corrélation +10 Risque capteur Faible · 24 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000010000000000000000000000000", "emulator_response_len": 16, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "i2p-router", "app_proto": "i2p-router", "asn": 211680, "country": "PT", "dst_port": 7657, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 0.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 24, "tag_count": 2, "anomaly_count": 0, "campaign_key": "339efece78174785e258f6f0537359ea11836cb3", "event_fingerprint": "25b3b55ddc8ede9f93f90f1cadb11050918e5788", "classification_reason": "Type \u00ab i2p_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.1, "classification_confidence": 0.1, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 24, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "i2p-router", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "63fac6162f0d2de1da7489cc7f99c131" }, "target_context": { "dst_port": 7657, "service": "i2p-router", "service_name": "i2p-router", "risk_score": 24 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5087736f45a564d64e0785462a35b83755e6051c", "protocol_details": { "port": 7657, "service": "i2p-router", "service_label_fr": "I2P ROUTER" }, "attack_vector": "i2p probe \u00b7 via I2P ROUTER:7657 \u00b7 (sonde \/ probe)", "target_port_label": "7657 \u00b7 I2P ROUTER", "emulator_service": "i2p-router", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab i2p_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab i2p_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 10, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 24, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 24, "risk_label": "Faible", "service_name": "i2p-router", "service_label_fr": "I2P ROUTER", "dst_port": 7657, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-i2p-router", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "port": 7657, "service": "i2p-router", "service_label_fr": "I2P ROUTER" }, "attack_vector": "i2p probe \u00b7 via I2P ROUTER:7657 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "7657 \u00b7 I2P ROUTER", "emulator_service": "i2p-router", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.128.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "i2p_router", "service_banner": "honeypot-i2p-router", "service_os": "linux", "dst_port": "7657" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "45.156.128.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "i2p_router_emulated", "net_i2p_probe" ] }
15/07/2026 06:02:34 UTC	TCP	7657 · I2P ROUTER	i2p-router	Sonde PostgreSQL postgres probe · via I2P ROUTER:7657 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur I2P-ROUTER WAF — Recommandation Surveiller Tags i2p_router_emulated i2p_router_payload net_i2p_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7657 Chemin / cible — Service I2P ROUTER Payload ��}��RXt e�}�(��f=�?��]�$} [�@��)Î>��Q��X&�걒.:HT&̨̩�/�0�+�,�� /5� L Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 59% Corrélation +10 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��}��RXt e�}�(��f=�?��]�$} [�@��)Î>��Q��X&�걒.:HT&̨̩�/�0�+�,�� /5� L Requête brute (extrait) ��}��RXt e�}�(��f=�?��]�$} [�@��)Î>��Q��X&�걒.:HT&̨̩�/�0�+�,�� /5� L � � http/1.1+3��f�T�yjElm,3��ڿ�9ě�� (W�\Gp��$ Meta JSON brut { "protocol_emulated": true, "emulator_response": "00000010000000000000000000000000", "emulator_response_len": 16, "bytes_in": 1476, "payload_entropy": 7.725923202398254, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "i2p-router", "app_proto": "i2p-router", "asn": 211680, "country": "PT", "dst_port": 7657, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de91c1a6ec5a88671ff4aa92129a41063b08c9a9", "event_fingerprint": "25b3b55ddc8ede9f93f90f1cadb11050918e5788", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "i2p-router", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cc4db265d397b0cf4bcd9cffc667d226", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 7657, "service": "i2p-router", "service_name": "i2p-router", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0013\ufffd}\ufffd\ufffdRXt\ne\u0002\ufffd}\ufffd(\ufffd\ufffd\u000f\ufffd\ufffdf=\u000e\ufffd?\ufffd\u0016\ufffd]\ufffd$} [\u000f\u0002\ufffd@\ufffd\ufffd)\u00ce\u001a>\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffdX&\ufffd\uac52.:HT\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0013\ufffd}\ufffd\ufffdRXt\ne\u0002\ufffd}\ufffd(\ufffd\ufffd\u000f\ufffd\ufffdf=\u000e\ufffd?\ufffd\u0016\ufffd]\ufffd$} [\u000f\u0002\ufffd@\ufffd\ufffd)\u00ce\u001a>\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffdX&\ufffd\uac52.:HT\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdf\ufffdT\ufffdyjElm,3\ufffd\ufffd\u06bf\ufffd9\u011b\ufffd\ufffd\f(W\ufffd\\Gp\ufffd\ufffd$", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0013\ufffd}\ufffd\ufffdRXt\ne\u0002\ufffd}\ufffd(\ufffd\ufffd\u000f\ufffd\ufffdf=\u000e\ufffd?\ufffd\u0016\ufffd]\ufffd$} [\u000f\u0002\ufffd@\ufffd\ufffd)\u00ce\u001a>\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffdX&\ufffd\uac52.:HT\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "55cde3c256a86a8ff07223cd7aba848820f652b7", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0013\ufffd}\ufffd\ufffdRXt\ne\u0002\ufffd}\ufffd(\ufffd\ufffd\u000f\ufffd\ufffdf=\u000e\ufffd?\ufffd\u0016\ufffd]\ufffd$} [\u000f\u0002\ufffd@\ufffd\ufffd)\u00ce\u001a>\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffdX&\ufffd\uac52.:HT\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "port": 7657, "service": "i2p-router", "service_label_fr": "I2P ROUTER" }, "evidence_snippet": "\ufffd\ufffd\ufffd}\ufffd\ufffdRXt\ne\ufffd}\ufffd(\ufffd\ufffd\ufffd\ufffdf=\ufffd?\ufffd\ufffd]\ufffd$} [\ufffd@\ufffd\ufffd)\u00ce>\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffdX&\ufffd\uac52.:HT&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\nL", "attack_vector": "postgres probe \u00b7 via I2P ROUTER:7657 \u00b7 (sonde \/ probe)", "target_port_label": "7657 \u00b7 I2P ROUTER", "emulator_service": "i2p-router", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 35, "risk_label": "Faible", "service_name": "i2p-router", "service_label_fr": "I2P ROUTER", "dst_port": 7657, "protocol_emulated": true, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-i2p-router", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0013\ufffd}\ufffd\ufffdRXt\ne\u0002\ufffd}\ufffd(\ufffd\ufffd\u000f\ufffd\ufffdf=\u000e\ufffd?\ufffd\u0016\ufffd]\ufffd$} [\u000f\u0002\ufffd@\ufffd\ufffd)\u00ce\u001a>\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffdX&\ufffd\uac52.:HT\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "port": 7657, "service": "i2p-router", "service_label_fr": "I2P ROUTER" }, "attack_vector": "postgres probe \u00b7 via I2P ROUTER:7657 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd}\ufffd\ufffdRXt\ne\ufffd}\ufffd(\ufffd\ufffd\ufffd\ufffdf=\ufffd?\ufffd\ufffd]\ufffd$} [\ufffd@\ufffd\ufffd)\u00ce>\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffdX&\ufffd\uac52.:HT&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\nL", "target_port_label": "7657 \u00b7 I2P ROUTER", "emulator_service": "i2p-router", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.128.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "i2p_router", "service_banner": "honeypot-i2p-router", "service_os": "linux", "dst_port": "7657" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "45.156.128.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "i2p_router_emulated", "i2p_router_payload", "net_i2p_probe", "tls_clienthello" ] }
11/07/2026 03:54:09 UTC	TCP	7777 · GAME UNREAL	game-unreal	Sonde SSH Sonde SSH · via GAME UNREAL:7777 · (sonde / probe)	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE T1046 TA0007 TA0001 Protocole Émulateur GAME-UNREAL WAF — Recommandation Surveiller Tags net_ssh_probe ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7777 Chemin / cible — Service GAME UNREAL Payload SSH-2.0-Go Pourquoi cette classification : Bannière client SSH reçue · confiance 95% Confiance classification 100% Corrélation +10 Risque capteur Moyen · 48 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-Go Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a", "emulator_response_len": 42, "bytes_in": 12, "payload_entropy": 3.2516291673878226, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "game-unreal", "app_proto": "game-unreal", "asn": 211680, "country": "PT", "dst_port": 7777, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 48, "tag_count": 2, "anomaly_count": 0, "campaign_key": "f1d93cbd5be3bcea2e323eb07f54c5270a2b777e", "event_fingerprint": "b2f29aab4a38e3a16e89080962f8bcc8b718b094", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 83, "precision_signals": [ "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0391" ], "matched_pattern_names": [ "SSH-2.0 banner RFC4253" ], "pattern_ids": [ "pat-0391" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 48, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "game-unreal", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 7777, "service": "game-unreal", "service_name": "game-unreal", "risk_score": 48 }, "payload_preview": "SSH-2.0-Go\r\n", "request_sample": "SSH-2.0-Go\r\n", "payload_snippet": "SSH-2.0-Go", "evidence": { "request_sample": "SSH-2.0-Go\r\n", "payload_snippet": "SSH-2.0-Go", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4ff99a6c2403f80ddebd7b9caf3c51a1448ddb4c", "protocol_details": { "payload_preview": "SSH-2.0-Go", "port": 7777, "service": "game-unreal", "service_label_fr": "GAME UNREAL" }, "evidence_snippet": "SSH-2.0-Go", "attack_vector": "Sonde SSH \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)", "target_port_label": "7777 \u00b7 GAME UNREAL", "emulator_service": "game-unreal", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 48, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 48, "risk_label": "Moyen", "service_name": "game-unreal", "service_label_fr": "GAME UNREAL", "dst_port": 7777, "protocol_emulated": true, "tags_summary": [ "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0391", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-game-unreal", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "SSH-2.0-Go", "port": 7777, "service": "game-unreal", "service_label_fr": "GAME UNREAL" }, "attack_vector": "Sonde SSH \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-Go", "target_port_label": "7777 \u00b7 GAME UNREAL", "emulator_service": "game-unreal", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.128.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "game_unreal", "service_banner": "honeypot-game-unreal", "service_os": "linux", "dst_port": "7777" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "45.156.128.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_ssh_probe", "ssh_banner" ] }
11/07/2026 03:54:05 UTC	TCP	7777 · GAME UNREAL	game-unreal	Sonde PostgreSQL postgres probe · via GAME UNREAL:7777 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur GAME-UNREAL WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7777 Chemin / cible — Service GAME UNREAL Payload ��wt�q��U��P�/�iؼ�(}�q7� �!O��c ��mgd�}U�ȌK}m�W q��&̨̩�/�0�+�,�� /5� L Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 59% Corrélation +10 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��wt�q��U��P�/�iؼ�(}�q7� �!O��c��mgd�}U�ȌK}m�Wq��&̨̩�/�0�+�,�� /5� L Requête brute (extrait) ��wt�q��U��P�/�iؼ�(}�q7� �!O��c ��mgd�}U�ȌK}m�W q��&̨̩�/�0�+�,�� /5� L � � http/1.1+3��=�b�)I%��D��g��VS�:ϺC2�d,l Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a", "emulator_response_len": 42, "bytes_in": 1476, "payload_entropy": 7.76794054308873, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "game-unreal", "app_proto": "game-unreal", "asn": 211680, "country": "PT", "dst_port": 7777, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "a80e1e975d546d6c38d71e2f91a00a66c01630bc", "event_fingerprint": "a35789f75452d6a73be983d5f266e3a77d710b7e", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "game-unreal", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "80e854a5dda5bf407cfbe4785afd4687", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 7777, "service": "game-unreal", "service_name": "game-unreal", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdwt\ufffdq\ufffd\ufffd\ufffdU\ufffd\u0015\ufffd\ufffdP\ufffd\/\u0017\ufffdi\u063c\ufffd(}\ufffdq\u00187\ufffd \ufffd\u0015\u001f!O\ufffd\ufffdc\f\ufffd\ufffdmgd\ufffd}U\ufffd\u001b\u020cK}m\ufffdW\u0004\fq\u0007\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdwt\ufffdq\ufffd\ufffd\ufffdU\ufffd\u0015\ufffd\ufffdP\ufffd\/\u0017\ufffdi\u063c\ufffd(}\ufffdq\u00187\ufffd \ufffd\u0015\u001f!O\ufffd\ufffdc\f\ufffd\ufffdmgd\ufffd}U\ufffd\u001b\u020cK}m\ufffdW\u0004\fq\u0007\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd=\ufffdb\ufffd)I%\ufffd\ufffdD\u0016\ufffd\ufffdg\ufffd\ufffd\ufffdVS\ufffd:\u001f\u03faC2\ufffdd,l", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdwt\ufffdq\ufffd\ufffd\ufffdU\ufffd\u0015\ufffd\ufffdP\ufffd\/\u0017\ufffdi\u063c\ufffd(}\ufffdq\u00187\ufffd \ufffd\u0015\u001f!O\ufffd\ufffdc\f\ufffd\ufffdmgd\ufffd}U\ufffd\u001b\u020cK}m\ufffdW\u0004\fq\u0007\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2058d1eae6e5751f171111043ca0168e6ca9eb0e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdwt\ufffdq\ufffd\ufffd\ufffdU\ufffd\u0015\ufffd\ufffdP\ufffd\/\u0017\ufffdi\u063c\ufffd(}\ufffdq\u00187\ufffd \ufffd\u0015\u001f!O\ufffd\ufffdc\f\ufffd\ufffdmgd\ufffd}U\ufffd\u001b\u020cK}m\ufffdW\u0004\fq\u0007\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "port": 7777, "service": "game-unreal", "service_label_fr": "GAME UNREAL" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdwt\ufffdq\ufffd\ufffd\ufffdU\ufffd\ufffd\ufffdP\ufffd\/\ufffdi\u063c\ufffd(}\ufffdq7\ufffd \ufffd!O\ufffd\ufffdc\ufffd\ufffdmgd\ufffd}U\ufffd\u020cK}m\ufffdWq\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\nL", "attack_vector": "postgres probe \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)", "target_port_label": "7777 \u00b7 GAME UNREAL", "emulator_service": "game-unreal", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 35, "risk_label": "Faible", "service_name": "game-unreal", "service_label_fr": "GAME UNREAL", "dst_port": 7777, "protocol_emulated": true, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-game-unreal", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdwt\ufffdq\ufffd\ufffd\ufffdU\ufffd\u0015\ufffd\ufffdP\ufffd\/\u0017\ufffdi\u063c\ufffd(}\ufffdq\u00187\ufffd \ufffd\u0015\u001f!O\ufffd\ufffdc\f\ufffd\ufffdmgd\ufffd}U\ufffd\u001b\u020cK}m\ufffdW\u0004\fq\u0007\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0005L\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "port": 7777, "service": "game-unreal", "service_label_fr": "GAME UNREAL" }, "attack_vector": "postgres probe \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdwt\ufffdq\ufffd\ufffd\ufffdU\ufffd\ufffd\ufffdP\ufffd\/\ufffdi\u063c\ufffd(}\ufffdq7\ufffd \ufffd!O\ufffd\ufffdc\ufffd\ufffdmgd\ufffd}U\ufffd\u020cK}m\ufffdWq\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\nL", "target_port_label": "7777 \u00b7 GAME UNREAL", "emulator_service": "game-unreal", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.128.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "game_unreal", "service_banner": "honeypot-game-unreal", "service_os": "linux", "dst_port": "7777" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "45.156.128.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ] }
11/07/2026 03:54:05 UTC	TCP	7777 · GAME UNREAL	game-unreal	Sonde jeu Unreal game-unreal · via GAME UNREAL:7777 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur GAME-UNREAL WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7777 Chemin / cible — Service GAME UNREAL Pourquoi cette classification : Type « game-unreal » (signaux protocolaires) · confiance 0% Confiance classification 10% Corrélation +10 Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a", "emulator_response_len": 42, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "game-unreal", "app_proto": "game-unreal", "asn": 211680, "country": "PT", "dst_port": 7777, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "1b3d300e4640d68205ab45deb6d5b1ebf8a12b3d", "event_fingerprint": "a35789f75452d6a73be983d5f266e3a77d710b7e", "classification_reason": "Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.1, "classification_confidence": 0.1, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "game-unreal", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "10384eda5161b41f764c9b11f5a8ba8f" }, "target_context": { "dst_port": 7777, "service": "game-unreal", "service_name": "game-unreal", "risk_score": 0 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9527121fc6aebc6f3291b99470b57d59466939ee", "protocol_details": { "port": 7777, "service": "game-unreal", "service_label_fr": "GAME UNREAL" }, "attack_vector": "game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)", "target_port_label": "7777 \u00b7 GAME UNREAL", "emulator_service": "game-unreal", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 10, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 0, "risk_label": "Faible", "service_name": "game-unreal", "service_label_fr": "GAME UNREAL", "dst_port": 7777, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-game-unreal", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "port": 7777, "service": "game-unreal", "service_label_fr": "GAME UNREAL" }, "attack_vector": "game-unreal \u00b7 via GAME UNREAL:7777 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "7777 \u00b7 GAME UNREAL", "emulator_service": "game-unreal", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.128.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "game_unreal", "service_banner": "honeypot-game-unreal", "service_os": "linux", "dst_port": "7777" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "45.156.128.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

45.156.128.53

Profil de menace

Pourquoi listée

Comparaison ASN / FAI

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence