Détails IP 45.156.129.87

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

web_probe

Comparaison ASN / FAI

ASN 211680 · 45.156.129.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 11 événements sur la période pour cette IP.

45.156.129.132 Sonde HTTP 24/07/2026 12:58 UTC
45.156.129.56 Sonde port 24/07/2026 12:58 UTC
45.156.128.203 Sonde HTTP 24/07/2026 10:57 UTC
45.156.128.172 Sonde port 24/07/2026 10:08 UTC
45.156.128.73 Sonde HTTP 24/07/2026 08:14 UTC
45.156.128.71 Sonde port 24/07/2026 08:14 UTC
45.156.129.170 Sonde port 3389/TCP 24/07/2026 07:42 UTC
45.156.129.168 Sonde port 3389/TCP 24/07/2026 07:42 UTC

IPs apparentées

Même FAI Sistemas Informaticos, S.A. — corrélation indicative.

45.156.129.132 Sonde HTTP
45.156.129.56 Sonde port
45.156.128.203 Sonde HTTP
45.156.128.172 Sonde port
45.156.128.73 Sonde HTTP

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 5 ORACLE EM TCP 4 SOURCE ENGINE TCP 1 CASSANDRA JMX TCP 1

HTTP

5

ORACLE EM

4

SOURCE ENGINE

1

CASSANDRA JMX

1

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

11 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
22/07/2026 09:32:20 UTC	TCP	8086 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8086 · (sonde / probe) · → /favicon.ico	—	Moyen · 40
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole GET /favicon.ico UA Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0… Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8086 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Moyen · 40 Confiance : Confiance 50 % — Motif catalogue confirmé · 1 tag(s) WAF Protocole émulé 1 Signaux Requête favicon.ico Single Port Chemin bénin connu Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Règles WAF nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:8086 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.63 Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:8086 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600", "emulator_response_len": 130, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "ico", "http_ua_hash": "c7e3312ad89b5c953c233d6bb536f12495aec80f", "http_host_hash": "dca14bd323afb7abea7bafa539fc0b23ad09cfc0", "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 187, "payload_entropy": 5.319260231569235, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "http", "app_proto": "http", "asn": 211680, "country": "PT", "dst_port": 8086, "risk_waf": 32, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 40, "tag_count": 2, "anomaly_count": 0, "campaign_key": "a4275fa0a4bf6fd0443d2bd4b44c8d2e717e2dbb", "event_fingerprint": "1ec73a9f48f7494b9784eea1188b6f2f7e3191a2", "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 94, "precision_signals": [ "INT-benign-favicon", "INT-single-port", "INT-benign-path-cap" ], "kb_rule_ids": [ "INT-benign-favicon", "INT-single-port", "INT-benign-path-cap" ], "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 40, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "4dcb5466a1cf9e92d38fdee8553b0c1e", "payload_hash": "1cbba3e31eac92580c910decaac43305", "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a" }, "target_context": { "dst_port": 8086, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8086\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63", "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "waf_tags": [ "950470:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8086\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8086\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63", "evidence": { "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "waf_tags": [ "950470:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8086\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8086\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63", "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2c1f304e8894fa4f50c920582e3e2a9dab711c17", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "port": 8086, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8086\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8086 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico", "target_port_label": "8086 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%", "classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 40, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8086, "protocol_emulated": true, "tags_summary": [ "INT-benign-favicon", "INT-single-port", "INT-benign-path-cap" ], "tags_summary_labels_fr": [ "Requ\u00eate favicon.ico", "Single Port", "Chemin b\u00e9nin connu" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "port": 8086, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8086 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico", "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8086\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63", "target_port_label": "8086 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +10 \u00b7 1 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.129.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8086" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "45.156.129.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "net_web_probe" ] }
13/07/2026 08:23:28 UTC	TCP	27015 · SOURCE ENGINE	source-engine	Sonde port 27015/TCP port 27015 tcp · via SOURCE ENGINE:27015 · (sonde / probe)	—	Moyen · 40
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOURCE-ENGINE WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 27015 Chemin / cible — Preuve honeypot — Sonde port 27015/TCP Connexion détectée sur le port 27015 (TCP) du capteur simulé. Service SOURCE ENGINE Payload SSH-2.0-Go Pourquoi cette classification : Bannière client SSH reçue · confiance 49% Confiance classification 59% Corrélation +10 Risque capteur Moyen · 40 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Signaux pat-0391 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-Go Meta JSON brut { "protocol_emulated": true, "emulator_response": "ffffffff4902536f7572636520456e67696e652051756572790005486f6e6579706f7400056373676f00000000000500", "emulator_response_len": 48, "bytes_in": 12, "payload_entropy": 3.2516291673878226, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "source-engine", "app_proto": "source-engine", "asn": 211680, "country": "PT", "dst_port": 27015, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "e688b38e2fcdc2725766e332934f7c245dfe0ae3", "event_fingerprint": "7846f7533178620776cfee34fe2035fddcf316dd", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 58, "precision_signals": [ "pat-0391" ], "kb_rule_ids": [ "pat-0391" ], "matched_patterns": [ "pat-0391" ], "matched_pattern_names": [ "SSH-2.0 banner RFC4253" ], "pattern_ids": [ "pat-0391" ], "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 40, "correlation_boost": 10 }, "named_classification_skipped": true, "named_candidate": "ssh_probe", "service_name": "source-engine", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d", "path_pattern_hash": "6713367a2c6ab13f024fbc459e237fb7" }, "target_context": { "dst_port": 27015, "service": "source-engine", "service_name": "source-engine", "risk_score": 40 }, "payload_preview": "SSH-2.0-Go\r\n", "request_sample": "SSH-2.0-Go\r\n", "payload_snippet": "SSH-2.0-Go", "evidence": { "request_sample": "SSH-2.0-Go\r\n", "payload_snippet": "SSH-2.0-Go", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f64e069c3ed2fe2d7493b0f6f7a58aa7f9842d06", "protocol_details": { "payload_preview": "SSH-2.0-Go", "port": 27015, "service": "source-engine", "service_label_fr": "SOURCE ENGINE" }, "evidence_snippet": "SSH-2.0-Go", "attack_vector": "port 27015 tcp \u00b7 via SOURCE ENGINE:27015 \u00b7 (sonde \/ probe)", "target_port_label": "27015 \u00b7 SOURCE ENGINE", "emulator_service": "source-engine", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 40, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 40, "risk_label": "Moyen", "service_name": "source-engine", "service_label_fr": "SOURCE ENGINE", "dst_port": 27015, "protocol_emulated": true, "tags_summary": [ "pat-0391" ], "tags_summary_labels_fr": [ "pat-0391" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-source-engine", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "SSH-2.0-Go", "port": 27015, "service": "source-engine", "service_label_fr": "SOURCE ENGINE" }, "attack_vector": "port 27015 tcp \u00b7 via SOURCE ENGINE:27015 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-Go", "target_port_label": "27015 \u00b7 SOURCE ENGINE", "emulator_service": "source-engine", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.129.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "source_engine", "service_banner": "honeypot-source-engine", "service_os": "linux", "dst_port": "27015" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "45.156.129.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor", "tags_list": [ "net_source_engine_probe", "source_engine_emulated", "ssh_banner" ] }
13/07/2026 02:36:56 UTC	TCP	9595 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9595 · (sonde / probe) · → /favicon.ico	—	Moyen · 40
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole GET /favicon.ico UA Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0… Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9595 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Moyen · 40 Confiance : Confiance 50 % — Motif catalogue confirmé · 1 tag(s) WAF Signaux Requête favicon.ico Single Port Chemin bénin connu Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Règles WAF nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:9595 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.63 Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:9595 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "ico", "http_ua_hash": "c7e3312ad89b5c953c233d6bb536f12495aec80f", "http_host_hash": "b57fc7370a8982e7e128ad5ab98a7de5ce0ef67d", "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 187, "payload_entropy": 5.332042902828931, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "http", "app_proto": "http", "asn": 211680, "country": "PT", "dst_port": 9595, "risk_waf": 32, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 40, "tag_count": 1, "anomaly_count": 0, "campaign_key": "3201420763d9e605749baf877adb3a83ad94230f", "event_fingerprint": "777be8743faa6bd710cf2307d7038dd4af1db058", "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 94, "precision_signals": [ "INT-benign-favicon", "INT-single-port", "INT-benign-path-cap" ], "kb_rule_ids": [ "INT-benign-favicon", "INT-single-port", "INT-benign-path-cap" ], "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 40, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "4dcb5466a1cf9e92d38fdee8553b0c1e", "payload_hash": "887ca5c22f9966a0827c58e8569ac8cb", "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a" }, "target_context": { "dst_port": 9595, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9595\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63", "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "waf_tags": [ "950470:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9595\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9595\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63", "evidence": { "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "waf_tags": [ "950470:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9595\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9595\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63", "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f66d884af8e928e73f36d14c2d03382193b495ca", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "port": 9595, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9595\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9595 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico", "target_port_label": "9595 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%", "classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 40, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9595, "protocol_emulated": null, "tags_summary": [ "INT-benign-favicon", "INT-single-port", "INT-benign-path-cap" ], "tags_summary_labels_fr": [ "Requ\u00eate favicon.ico", "Single Port", "Chemin b\u00e9nin connu" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "port": 9595, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9595 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico", "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9595\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63", "target_port_label": "9595 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +10 \u00b7 1 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.129.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9595" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "45.156.129.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3" ] }
10/07/2026 21:30:42 UTC	TCP	8001 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8001 · (sonde / probe)	—	Moyen · 40
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole GET / UA Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0… Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8001 Chemin / cible / Service HTTP Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 74% Confiance classification 84% Corrélation +10 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 44 · 2 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safar Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "c7e3312ad89b5c953c233d6bb536f12495aec80f", "http_host_hash": "29d114ae8a3567c5f1863f5bd79c5d398a432fe8", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 176, "payload_entropy": 5.307244835743901, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "http", "app_proto": "http", "asn": 211680, "country": "PT", "dst_port": 8001, "risk_waf": 44, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 44, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "5b2a97dcefb94379cd13af6587aebe0fc9568b47", "event_fingerprint": "4e6df831104c478773484d81444065b3f20e1b1b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "4dcb5466a1cf9e92d38fdee8553b0c1e", "payload_hash": "4ae3d07d63a97be05efd4618e0835591", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "service_name": "http", "target_context": { "dst_port": 8001, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar", "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 74%" }, "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 44, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 40, "correlation_boost": 10 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.84, "classification_confidence": 0.84, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "475d729b1a688188e56bd5c34d7c05080b56b608", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "port": 8001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8001 \u00b7 (sonde \/ probe)", "target_port_label": "8001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 74%", "classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 84, "confidence_breakdown": { "waf": 44, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 40, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8001, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "port": 8001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8001 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8001\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar", "target_port_label": "8001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 84 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +10 \u00b7 2 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.129.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "45.156.129.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ] }
30/06/2026 23:35:43 UTC	TCP	9943 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9943 · (sonde / probe)	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0… Émulateur HTTP WAF 9 Recommandation Surveiller Tags 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9943 Chemin / cible / Service HTTP Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 71% Confiance classification 71% Risque capteur Moyen · 40 Confiance : Confiance 71 % — Score WAF 44 · 2 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Règles WAF nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9943 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safar Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9943 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Accept: / Accept-Encoding: gzip Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "c7e3312ad89b5c953c233d6bb536f12495aec80f", "http_host_hash": "81fa59c30676c79c526a5d0aacd8613776c6117a", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 176, "payload_entropy": 5.340054139782635, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "http", "app_proto": "http", "asn": 211680, "country": "PT", "dst_port": 9943, "risk_waf": 44, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 44, "classification": 38, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 40, "tag_count": 2, "anomaly_count": 0, "campaign_key": "63cee5ae9d353452c771a291f7b849301aa0e577", "event_fingerprint": "9b900c931eaea0b9b4af350a3536115d389d9ad3", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "4dcb5466a1cf9e92d38fdee8553b0c1e", "payload_hash": "d3e11305bb29ae6f12428ef498d121fe", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "service_name": "http", "target_context": { "dst_port": 9943, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9943\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9943\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9943\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "waf_tags": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9943\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9943\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar", "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%" }, "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%", "confidence_breakdown": { "waf": 44, "classification": 38, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.71, "classification_confidence": 0.71, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d46cfb5eb43a5f4733f5014cc1adbf00bd405211", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "port": 9943, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9943\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9943 \u00b7 (sonde \/ probe)", "target_port_label": "9943 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 71 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%", "classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 71%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 71, "confidence_breakdown": { "waf": 44, "classification": 38, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9943, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "port": 9943, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9943 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9943\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safar", "target_port_label": "9943 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 71 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 44 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9943" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
30/06/2026 03:52:41 UTC	TCP	7000 · CASSANDRA JMX	cassandra-jmx	cassandra probe cassandra probe · via CASSANDRA JMX:7000 · (sonde / probe)	—	Faible · 34
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur CASSANDRA-JMX WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7000 Chemin / cible — Service CASSANDRA JMX Pourquoi cette classification : Type « cassandra_probe » (signaux protocolaires) · confiance 0% Confiance classification 10% Corrélation +10 Risque capteur Faible · 34 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "4f4b0d0a", "emulator_response_len": 4, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "cassandra-jmx", "app_proto": "cassandra-jmx", "asn": 211680, "country": "PT", "dst_port": 7000, "risk_waf": 8, "risk_classification": 55, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 8, "classification": 55, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 34, "tag_count": 2, "anomaly_count": 0, "campaign_key": "0f2b3f688e52b847eec81bfc3a7ca929d263c647", "event_fingerprint": "0515a90696fafcab67973d1c4c56caf19b56703e", "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.1, "classification_confidence": 0.1, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 55, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 34, "correlation_boost": 10 }, "named_classification_skipped": false, "service_name": "cassandra-jmx", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "4ab235198c4b31da3311b42124ef3494" }, "target_context": { "dst_port": 7000, "service": "cassandra-jmx", "service_name": "cassandra-jmx", "risk_score": 34 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5a8e77f85013084f1d7f610baac29bf346ce744e", "protocol_details": { "port": 7000, "service": "cassandra-jmx", "service_label_fr": "CASSANDRA JMX" }, "attack_vector": "cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)", "target_port_label": "7000 \u00b7 CASSANDRA JMX", "emulator_service": "cassandra-jmx", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 10, "confidence_breakdown": { "waf": 8, "classification": 55, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 34, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 34, "risk_label": "Faible", "service_name": "cassandra-jmx", "service_label_fr": "CASSANDRA JMX", "dst_port": 7000, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cassandra-jmx", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "port": 7000, "service": "cassandra-jmx", "service_label_fr": "CASSANDRA JMX" }, "attack_vector": "cassandra probe \u00b7 via CASSANDRA JMX:7000 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "7000 \u00b7 CASSANDRA JMX", "emulator_service": "cassandra-jmx", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.129.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cassandra_jmx", "service_banner": "honeypot-cassandra-jmx", "service_os": "linux", "dst_port": "7000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "45.156.129.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cassandra_emulated", "net_cassandra_probe" ] }
29/06/2026 19:58:15 UTC	TCP	7443 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:7443 · (sonde / probe) · → /favicon.ico	—	Moyen · 40
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /favicon.ico UA Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0… Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7443 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 50% Confiance classification 68% Corrélation +18 Risque capteur Moyen · 40 Confiance : Confiance 50 % — Motif catalogue confirmé · 1 tag(s) WAF Protocole émulé 1 Signaux Requête favicon.ico Single Port Chemin bénin connu Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Règles WAF nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:7443 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.63 Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:7443 User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600", "emulator_response_len": 130, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "ico", "http_ua_hash": "c7e3312ad89b5c953c233d6bb536f12495aec80f", "http_host_hash": "3207cc58a88e4dd65c61f1b1f14e699cc0722bbe", "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 187, "payload_entropy": 5.332390130456047, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "http", "app_proto": "http", "asn": 211680, "country": "PT", "dst_port": 7443, "risk_waf": 32, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.2, "risk_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 40, "tag_count": 2, "anomaly_count": 0, "campaign_key": "308eeb07694581476efec0bd14725a260f2e7949", "event_fingerprint": "fa4c875e76c20b3566e7729967f30f3b8a21337d", "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%", "confidence": 0.68, "classification_confidence": 0.68, "precision_score": 94, "precision_signals": [ "INT-benign-favicon", "INT-single-port", "INT-benign-path-cap" ], "kb_rule_ids": [ "INT-benign-favicon", "INT-single-port", "INT-benign-path-cap" ], "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 40, "correlation_boost": 18 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "4dcb5466a1cf9e92d38fdee8553b0c1e", "payload_hash": "83730dc1b04ff5a8688c3bf89f1eabb5", "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a" }, "target_context": { "dst_port": 7443, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63", "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "waf_tags": [ "950470:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63", "evidence": { "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "waf_tags": [ "950470:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63", "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "caf69a5c1e82e30517233582ffd716ec84af5c2e", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "port": 7443, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63", "attack_vector": "Sonde HTTP \u00b7 via HTTP:7443 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico", "target_port_label": "7443 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%", "classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 68, "confidence_breakdown": { "waf": 32, "classification": 38, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 40, "correlation_boost": 18 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7443, "protocol_emulated": true, "tags_summary": [ "INT-benign-favicon", "INT-single-port", "INT-benign-path-cap" ], "tags_summary_labels_fr": [ "Requ\u00eate favicon.ico", "Single Port", "Chemin b\u00e9nin connu" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "scan_coordonn\u00e9", "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9", "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +18", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.86 Safari\/537.36", "port": 7443, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:7443 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico", "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nUser-Agent: Mozilla\/5.0 AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.63", "target_port_label": "7443 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +18 \u00b7 1 tag(s) WAF", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.129.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "oracle-em" ], "multi_protocol_window_s": 300, "coordinated_scan": true, "coordinated_subnet": "45.156.129.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan", "multi_protocol_correlation" ], "correlation_confidence_boost": 18, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950470:nosqli-3", "net_web_probe" ] }
29/06/2026 19:57:59 UTC	TCP	7443 · ORACLE EM	oracle-em	oracle tns probe oracle tns probe · via ORACLE EM:7443 · (sonde / probe)	—	Moyen · 45
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur ORACLE-EM WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7443 Chemin / cible — Service ORACLE EM Payload ��&[��m�m�m��Tc`3S�\|�ޫ}&ߎ@ �?W�� C�q�gĆ2��P ֧��o&�o��,�0��̨̩̪��]�a�W�S�+�/�� Pourquoi cette classification : Type « oracle_tns_probe » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��&[��m�m�m��Tc`3S�\|�ޫ}&ߎ@ �?W��C�q�gĆ2��P ֧��o&�o��,�0��̨̩̪��]�a�W�S�+�/�� Requête brute (extrait) ��&[��m�m�m��Tc`3S�\|�ޫ}&ߎ@ �?W�� C�q�gĆ2��P ֧��o&�o��,�0��̨̩̪��]�a�W�S�+�/��\�`�V�R�$�(kj�s�w��#�'g@�r�v�� 98�� 32��ED��Q��P=�<�5�/�A �� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 407, "payload_entropy": 5.782738592207957, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "oracle-em", "app_proto": "oracle-em", "asn": 211680, "country": "PT", "dst_port": 7443, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 4, "anomaly_count": 0, "campaign_key": "4f4acff4c9041c67c73fa498ee94611b63a0dc4b", "event_fingerprint": "3f1d4b52645bcd9531502ab86dc099f88926bef6", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 10 }, "service_name": "oracle-em", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3ba88d0bce4cfa4fc117767589de6499", "path_pattern_hash": "420e91c120535c16728a9791d446fafc" }, "target_context": { "dst_port": 7443, "service": "oracle-em", "service_name": "oracle-em", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003&\u0007[\ufffd\ufffd\ufffdm\ufffdm\ufffdm\ufffd\u0001\ufffd\ufffd\u001e\ufffdTc`3S\ufffd\|\ufffd\u07ab}&\u07ce@ \ufffd?W\ufffd\ufffd\u0004\f\ufffdC\ufffdq\ufffd\u0017g\u01062\ufffd\ufffdP \u05a7\ufffd\ufffd\ufffdo&\ufffdo\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003&\u0007[\ufffd\ufffd\ufffdm\ufffdm\ufffdm\ufffd\u0001\ufffd\ufffd\u001e\ufffdTc`3S\ufffd\|\ufffd\u07ab}&\u07ce@ \ufffd?W\ufffd\ufffd\u0004\f\ufffdC\ufffdq\ufffd\u0017g\u01062\ufffd\ufffdP \u05a7\ufffd\ufffd\ufffdo&\ufffdo\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0007\ufffd\u0011\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd\u0000A\u0000\u0007\u0000\u0005\u0000\n\u0000\ufffd\u0001\u0000\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003&\u0007[\ufffd\ufffd\ufffdm\ufffdm\ufffdm\ufffd\u0001\ufffd\ufffd\u001e\ufffdTc`3S\ufffd\|\ufffd\u07ab}&\u07ce@ \ufffd?W\ufffd\ufffd\u0004\f\ufffdC\ufffdq\ufffd\u0017g\u01062\ufffd\ufffdP \u05a7\ufffd\ufffd\ufffdo&\ufffdo\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6ac508fa89295ea3f6c6785d6d20def42c0fded6", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003&\u0007[\ufffd\ufffd\ufffdm\ufffdm\ufffdm\ufffd\u0001\ufffd\ufffd\u001e\ufffdTc`3S\ufffd\|\ufffd\u07ab}&\u07ce@ \ufffd?W\ufffd\ufffd\u0004\f\ufffdC\ufffdq\ufffd\u0017g\u01062\ufffd\ufffdP \u05a7\ufffd\ufffd\ufffdo&\ufffdo\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 7443, "service": "oracle-em", "service_label_fr": "ORACLE EM" }, "evidence_snippet": "\ufffd\ufffd&[\ufffd\ufffd\ufffdm\ufffdm\ufffdm\ufffd\ufffd\ufffd\ufffdTc`3S\ufffd\|\ufffd\u07ab}&\u07ce@ \ufffd?W\ufffd\ufffd\ufffdC\ufffdq\ufffdg\u01062\ufffd\ufffdP \u05a7\ufffd\ufffd\ufffdo&\ufffdo\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "oracle tns probe \u00b7 via ORACLE EM:7443 \u00b7 (sonde \/ probe)", "target_port_label": "7443 \u00b7 ORACLE EM", "emulator_service": "oracle-em", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 45, "risk_label": "Moyen", "service_name": "oracle-em", "service_label_fr": "ORACLE EM", "dst_port": 7443, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-oracle-em", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003&\u0007[\ufffd\ufffd\ufffdm\ufffdm\ufffdm\ufffd\u0001\ufffd\ufffd\u001e\ufffdTc`3S\ufffd\|\ufffd\u07ab}&\u07ce@ \ufffd?W\ufffd\ufffd\u0004\f\ufffdC\ufffdq\ufffd\u0017g\u01062\ufffd\ufffdP \u05a7\ufffd\ufffd\ufffdo&\ufffdo\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 7443, "service": "oracle-em", "service_label_fr": "ORACLE EM" }, "attack_vector": "oracle tns probe \u00b7 via ORACLE EM:7443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd&[\ufffd\ufffd\ufffdm\ufffdm\ufffdm\ufffd\ufffd\ufffd\ufffdTc`3S\ufffd\|\ufffd\u07ab}&\u07ce@ \ufffd?W\ufffd\ufffd\ufffdC\ufffdq\ufffdg\u01062\ufffd\ufffdP \u05a7\ufffd\ufffd\ufffdo&\ufffdo\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "7443 \u00b7 ORACLE EM", "emulator_service": "oracle-em", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.129.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "oracle_em", "service_banner": "honeypot-oracle-em", "service_os": "linux", "dst_port": "7443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "45.156.129.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_oracle_tns_probe", "oracle_em_emulated", "oracle_em_payload", "tls_clienthello" ] }
29/06/2026 19:57:59 UTC	TCP	7443 · ORACLE EM	oracle-em	oracle tns probe oracle tns probe · via ORACLE EM:7443 · (sonde / probe)	—	Moyen · 45
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur ORACLE-EM WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7443 Chemin / cible — Service ORACLE EM Payload ��N��0�A��C��.8��pq��f�T) 4t#MŅ��H��8��$hX�)g3�M#��,�0��̨̩̪��]�a�W�S�+�/�� Pourquoi cette classification : Type « oracle_tns_probe » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��N��0�A��C��.8��pq��f�T) 4t#MŅ��H��8��$hX�)g3�M#��,�0��̨̩̪��]�a�W�S�+�/�� Requête brute (extrait) ��N��0�A��C��.8��pq��f�T) 4t#MŅ��H��8��$hX�)g3�M#��,�0��̨̩̪��]�a�W�S�+�/��\�`�V�R�$�(kj�s�w��#�'g@�r�v�� 98�� 32��ED��Q��P=�<�5�/�A �� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 407, "payload_entropy": 5.859496427239591, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "oracle-em", "app_proto": "oracle-em", "asn": 211680, "country": "PT", "dst_port": 7443, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 4, "anomaly_count": 0, "campaign_key": "4f4acff4c9041c67c73fa498ee94611b63a0dc4b", "event_fingerprint": "3f1d4b52645bcd9531502ab86dc099f88926bef6", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 10 }, "service_name": "oracle-em", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5fdb664d77aedd66f805498b927a4617", "path_pattern_hash": "420e91c120535c16728a9791d446fafc" }, "target_context": { "dst_port": 7443, "service": "oracle-em", "service_name": "oracle-em", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003N\ufffd\ufffd0\u0007\ufffdA\ufffd\ufffd\ufffdC\ufffd\ufffd\u001d.8\ufffd\ufffd\u000fp\u0011q\ufffd\ufffd\ufffd\ufffdf\ufffd\u001cT) 4t#\u0018M\u0010\u0145\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffd\ufffd$h\u0011X\ufffd)g3\ufffdM#\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003N\ufffd\ufffd0\u0007\ufffdA\ufffd\ufffd\ufffdC\ufffd\ufffd\u001d.8\ufffd\ufffd\u000fp\u0011q\ufffd\ufffd\ufffd\ufffdf\ufffd\u001cT) 4t#\u0018M\u0010\u0145\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffd\ufffd$h\u0011X\ufffd)g3\ufffdM#\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0007\ufffd\u0011\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd\u0000A\u0000\u0007\u0000\u0005\u0000\n\u0000\ufffd\u0001\u0000\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003N\ufffd\ufffd0\u0007\ufffdA\ufffd\ufffd\ufffdC\ufffd\ufffd\u001d.8\ufffd\ufffd\u000fp\u0011q\ufffd\ufffd\ufffd\ufffdf\ufffd\u001cT) 4t#\u0018M\u0010\u0145\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffd\ufffd$h\u0011X\ufffd)g3\ufffdM#\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5bba2d26f7aab3c1414d4012c68d77e7f231ac7b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003N\ufffd\ufffd0\u0007\ufffdA\ufffd\ufffd\ufffdC\ufffd\ufffd\u001d.8\ufffd\ufffd\u000fp\u0011q\ufffd\ufffd\ufffd\ufffdf\ufffd\u001cT) 4t#\u0018M\u0010\u0145\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffd\ufffd$h\u0011X\ufffd)g3\ufffdM#\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 7443, "service": "oracle-em", "service_label_fr": "ORACLE EM" }, "evidence_snippet": "\ufffd\ufffdN\ufffd\ufffd0\ufffdA\ufffd\ufffd\ufffdC\ufffd\ufffd.8\ufffd\ufffdpq\ufffd\ufffd\ufffd\ufffdf\ufffdT) 4t#M\u0145\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffd\ufffd$hX\ufffd)g3\ufffdM#\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "oracle tns probe \u00b7 via ORACLE EM:7443 \u00b7 (sonde \/ probe)", "target_port_label": "7443 \u00b7 ORACLE EM", "emulator_service": "oracle-em", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 45, "risk_label": "Moyen", "service_name": "oracle-em", "service_label_fr": "ORACLE EM", "dst_port": 7443, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-oracle-em", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003N\ufffd\ufffd0\u0007\ufffdA\ufffd\ufffd\ufffdC\ufffd\ufffd\u001d.8\ufffd\ufffd\u000fp\u0011q\ufffd\ufffd\ufffd\ufffdf\ufffd\u001cT) 4t#\u0018M\u0010\u0145\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffd\ufffd$h\u0011X\ufffd)g3\ufffdM#\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 7443, "service": "oracle-em", "service_label_fr": "ORACLE EM" }, "attack_vector": "oracle tns probe \u00b7 via ORACLE EM:7443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdN\ufffd\ufffd0\ufffdA\ufffd\ufffd\ufffdC\ufffd\ufffd.8\ufffd\ufffdpq\ufffd\ufffd\ufffd\ufffdf\ufffdT) 4t#M\u0145\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffd\ufffd$hX\ufffd)g3\ufffdM#\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "7443 \u00b7 ORACLE EM", "emulator_service": "oracle-em", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.129.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "oracle_em", "service_banner": "honeypot-oracle-em", "service_os": "linux", "dst_port": "7443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "45.156.129.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_oracle_tns_probe", "oracle_em_emulated", "oracle_em_payload", "tls_clienthello" ] }
29/06/2026 19:57:58 UTC	TCP	7443 · ORACLE EM	oracle-em	oracle tns probe oracle tns probe · via ORACLE EM:7443 · (sonde / probe)	—	Moyen · 45
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur ORACLE-EM WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7443 Chemin / cible — Service ORACLE EM Payload ��.ᘿua�[�+WzZ��T("�U>�吼�'�� q�C�q �7wgQ}]T��g�r�ر��,�0��̨̩̪��]�a�W�S�+�/�� Pourquoi cette classification : Type « oracle_tns_probe » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��.ᘿua�[�+WzZ��T("�U>�吼�'�� q�C�q �7wgQ}]T��g�r�ر��,�0��̨̩̪��]�a�W�S�+�/�� Requête brute (extrait) ��.ᘿua�[�+WzZ��T("�U>�吼�'�� q�C�q �7wgQ}]T��g�r�ر��,�0��̨̩̪��]�a�W�S�+�/��\�`�V�R�$�(kj�s�w��#�'g@�r�v�� 98�� 32��ED��Q��P=�<�5�/�A �� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 407, "payload_entropy": 5.816481656256206, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "oracle-em", "app_proto": "oracle-em", "asn": 211680, "country": "PT", "dst_port": 7443, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 4, "anomaly_count": 0, "campaign_key": "4f4acff4c9041c67c73fa498ee94611b63a0dc4b", "event_fingerprint": "3f1d4b52645bcd9531502ab86dc099f88926bef6", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 10 }, "service_name": "oracle-em", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "958e3e65c1d15d8eb3a17b213e14892f", "path_pattern_hash": "420e91c120535c16728a9791d446fafc" }, "target_context": { "dst_port": 7443, "service": "oracle-em", "service_name": "oracle-em", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003.\u163fua\ufffd[\ufffd+Wz\bZ\ufffd\ufffdT(\"\ufffdU>\ufffd\u543c\ufffd'\ufffd\ufffd\u0005 \ufffd\ufffdq\ufffdC\ufffdq \ufffd7wgQ}]\u001dT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffdr\u0007\ufffd\u0631\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003.\u163fua\ufffd[\ufffd+Wz\bZ\ufffd\ufffdT(\"\ufffdU>\ufffd\u543c\ufffd'\ufffd\ufffd\u0005 \ufffd\ufffdq\ufffdC\ufffdq \ufffd7wgQ}]\u001dT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffdr\u0007\ufffd\u0631\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0007\ufffd\u0011\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd\u0000A\u0000\u0007\u0000\u0005\u0000\n\u0000\ufffd\u0001\u0000\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003.\u163fua\ufffd[\ufffd+Wz\bZ\ufffd\ufffdT(\"\ufffdU>\ufffd\u543c\ufffd'\ufffd\ufffd\u0005 \ufffd\ufffdq\ufffdC\ufffdq \ufffd7wgQ}]\u001dT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffdr\u0007\ufffd\u0631\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3f426d38a7cc1fc5dfa28b0cc049615624af94bf", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003.\u163fua\ufffd[\ufffd+Wz\bZ\ufffd\ufffdT(\"\ufffdU>\ufffd\u543c\ufffd'\ufffd\ufffd\u0005 \ufffd\ufffdq\ufffdC\ufffdq \ufffd7wgQ}]\u001dT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffdr\u0007\ufffd\u0631\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 7443, "service": "oracle-em", "service_label_fr": "ORACLE EM" }, "evidence_snippet": "\ufffd\ufffd.\u163fua\ufffd[\ufffd+WzZ\ufffd\ufffdT(\"\ufffdU>\ufffd\u543c\ufffd'\ufffd\ufffd \ufffd\ufffdq\ufffdC\ufffdq \ufffd7wgQ}]T\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffdr\ufffd\u0631\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "oracle tns probe \u00b7 via ORACLE EM:7443 \u00b7 (sonde \/ probe)", "target_port_label": "7443 \u00b7 ORACLE EM", "emulator_service": "oracle-em", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 45, "risk_label": "Moyen", "service_name": "oracle-em", "service_label_fr": "ORACLE EM", "dst_port": 7443, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-oracle-em", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003.\u163fua\ufffd[\ufffd+Wz\bZ\ufffd\ufffdT(\"\ufffdU>\ufffd\u543c\ufffd'\ufffd\ufffd\u0005 \ufffd\ufffdq\ufffdC\ufffdq \ufffd7wgQ}]\u001dT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffdr\u0007\ufffd\u0631\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 7443, "service": "oracle-em", "service_label_fr": "ORACLE EM" }, "attack_vector": "oracle tns probe \u00b7 via ORACLE EM:7443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd.\u163fua\ufffd[\ufffd+WzZ\ufffd\ufffdT(\"\ufffdU>\ufffd\u543c\ufffd'\ufffd\ufffd \ufffd\ufffdq\ufffdC\ufffdq \ufffd7wgQ}]T\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffdr\ufffd\u0631\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "7443 \u00b7 ORACLE EM", "emulator_service": "oracle-em", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.129.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "oracle_em", "service_banner": "honeypot-oracle-em", "service_os": "linux", "dst_port": "7443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "45.156.129.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_oracle_tns_probe", "oracle_em_emulated", "oracle_em_payload", "tls_clienthello" ] }
29/06/2026 19:57:57 UTC	TCP	7443 · ORACLE EM	oracle-em	oracle tns probe oracle tns probe · via ORACLE EM:7443 · (sonde / probe)	—	Moyen · 45
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur ORACLE-EM WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7443 Chemin / cible — Service ORACLE EM Payload ��/M[��pS�S�<�K��[�i� �e"��n#� áMI��밶�? �!��T��0l�m& ��,�0��̨̩̪��]�a�W�S�+�/�� Pourquoi cette classification : Type « oracle_tns_probe » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��/M[��pS�S�<�K��[�i��e"��n#� áMI��밶�? �!��T��0l�m&��,�0��̨̩̪��]�a�W�S�+�/�� Requête brute (extrait) ��/M[��pS�S�<�K��[�i� �e"��n#� áMI��밶�? �!��T��0l�m& ��,�0��̨̩̪��]�a�W�S�+�/��\�`�V�R�$�(kj�s�w��#�'g@�r�v�� 98�� 32��ED��Q��P=�<�5�/�A �� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 407, "payload_entropy": 5.8585325756911555, "port_category": "registered", "org": "Sistemas Informaticos, S.A.", "service": "oracle-em", "app_proto": "oracle-em", "asn": 211680, "country": "PT", "dst_port": 7443, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 4, "anomaly_count": 0, "campaign_key": "4f4acff4c9041c67c73fa498ee94611b63a0dc4b", "event_fingerprint": "3f1d4b52645bcd9531502ab86dc099f88926bef6", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 10 }, "service_name": "oracle-em", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "PT", "asn": 211680, "org": "Sistemas Informaticos, S.A.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7bb344445332e865c027236cb9ff8ac6", "path_pattern_hash": "420e91c120535c16728a9791d446fafc" }, "target_context": { "dst_port": 7443, "service": "oracle-em", "service_name": "oracle-em", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\/M[\ufffd\ufffdpS\ufffdS\ufffd<\ufffd\u0017K\ufffd\u0006\ufffd\ufffd[\ufffdi\ufffd\u000b\ufffde\"\ufffd\ufffd\ufffdn#\ufffd \u00e1MI\ufffd\u0010\ufffd\ubc36\ufffd?\u0006 \ufffd\u000f!\ufffd\ufffd\ufffdT\ufffd\ufffd0\u001bl\ufffdm&\u000b\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\/M[\ufffd\ufffdpS\ufffdS\ufffd<\ufffd\u0017K\ufffd\u0006\ufffd\ufffd[\ufffdi\ufffd\u000b\ufffde\"\ufffd\ufffd\ufffdn#\ufffd \u00e1MI\ufffd\u0010\ufffd\ubc36\ufffd?\u0006 \ufffd\u000f!\ufffd\ufffd\ufffdT\ufffd\ufffd0\u001bl\ufffdm&\u000b\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0007\ufffd\u0011\ufffd\b\ufffd\u0012\u0000\u0016\u0000\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd\u0000A\u0000\u0007\u0000\u0005\u0000\n\u0000\ufffd\u0001\u0000\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\/M[\ufffd\ufffdpS\ufffdS\ufffd<\ufffd\u0017K\ufffd\u0006\ufffd\ufffd[\ufffdi\ufffd\u000b\ufffde\"\ufffd\ufffd\ufffdn#\ufffd \u00e1MI\ufffd\u0010\ufffd\ubc36\ufffd?\u0006 \ufffd\u000f!\ufffd\ufffd\ufffdT\ufffd\ufffd0\u001bl\ufffdm&\u000b\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8bdf119c27956a317a1582f01802a78c93c72c26", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\/M[\ufffd\ufffdpS\ufffdS\ufffd<\ufffd\u0017K\ufffd\u0006\ufffd\ufffd[\ufffdi\ufffd\u000b\ufffde\"\ufffd\ufffd\ufffdn#\ufffd \u00e1MI\ufffd\u0010\ufffd\ubc36\ufffd?\u0006 \ufffd\u000f!\ufffd\ufffd\ufffdT\ufffd\ufffd0\u001bl\ufffdm&\u000b\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 7443, "service": "oracle-em", "service_label_fr": "ORACLE EM" }, "evidence_snippet": "\ufffd\ufffd\/M[\ufffd\ufffdpS\ufffdS\ufffd<\ufffdK\ufffd\ufffd\ufffd[\ufffdi\ufffd\ufffde\"\ufffd\ufffd\ufffdn#\ufffd \u00e1MI\ufffd\ufffd\ubc36\ufffd? \ufffd!\ufffd\ufffd\ufffdT\ufffd\ufffd0l\ufffdm&\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "oracle tns probe \u00b7 via ORACLE EM:7443 \u00b7 (sonde \/ probe)", "target_port_label": "7443 \u00b7 ORACLE EM", "emulator_service": "oracle-em", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 45, "risk_label": "Moyen", "service_name": "oracle-em", "service_label_fr": "ORACLE EM", "dst_port": 7443, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-oracle-em", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\/M[\ufffd\ufffdpS\ufffdS\ufffd<\ufffd\u0017K\ufffd\u0006\ufffd\ufffd[\ufffdi\ufffd\u000b\ufffde\"\ufffd\ufffd\ufffdn#\ufffd \u00e1MI\ufffd\u0010\ufffd\ubc36\ufffd?\u0006 \ufffd\u000f!\ufffd\ufffd\ufffdT\ufffd\ufffd0\u001bl\ufffdm&\u000b\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 7443, "service": "oracle-em", "service_label_fr": "ORACLE EM" }, "attack_vector": "oracle tns probe \u00b7 via ORACLE EM:7443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\/M[\ufffd\ufffdpS\ufffdS\ufffd<\ufffdK\ufffd\ufffd\ufffd[\ufffdi\ufffd\ufffde\"\ufffd\ufffd\ufffdn#\ufffd \u00e1MI\ufffd\ufffd\ubc36\ufffd? \ufffd!\ufffd\ufffd\ufffdT\ufffd\ufffd0l\ufffdm&\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "7443 \u00b7 ORACLE EM", "emulator_service": "oracle-em", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.156.129.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "oracle_em", "service_banner": "honeypot-oracle-em", "service_os": "linux", "dst_port": "7443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "45.156.129.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_oracle_tns_probe", "oracle_em_emulated", "oracle_em_payload", "tls_clienthello" ] }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

45.156.129.87

Profil de menace

Pourquoi listée

Comparaison ASN / FAI

Activité multi-protocole

Géolocalisation

FAI / réseau

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence