Renseignement sur les menaces

Pays-Bas

45.156.87.31

FAI TechTies Inc. Première vue 04/06/2026 09:31 UTC Dernière vue 23/07/2026 10:40 UTC Risque Moyen

Période analysée : 2026-04-24 → 2026-07-23

Activité suspecte — risque 50/100 (Moyen) — MITRE T1046 — confiance 100 % — via SSH

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 50/100 Moyen

Première observation 04/06/2026 09:31 UTC

Dernière observation 23/07/2026 10:40 UTC

Événements (période) 88

MITRE ATT&CK principal TA0007 37 occurrences

Activité suspecte — risque 50/100 (Moyen) — MITRE T1046 — confiance 100 % — via SSH

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Bannière client SSH reçue · confiance 100%

Confiance 100 % — Score WAF 8

Comparaison ASN / FAI

ASN 197170 · 45.156.87.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 88 événements sur la période pour cette IP.

45.156.87.153 Sonde HTTP 23/07/2026 16:31 UTC
94.26.106.234 Sonde SSH 23/07/2026 16:19 UTC
45.156.87.178 Sonde HTTP 23/07/2026 16:10 UTC
93.152.221.50 Sonde HTTP 23/07/2026 16:01 UTC
85.11.167.154 Sonde SSH 23/07/2026 16:00 UTC
45.156.87.162 Sonde HTTP 23/07/2026 15:46 UTC
91.92.47.128 Sonde SSH 23/07/2026 15:18 UTC
45.156.87.163 Sonde SSH 23/07/2026 14:43 UTC

Événements (filtres)

Première observation

04/06/2026 09:31 UTC

Dernière observation

23/07/2026 10:40 UTC

Dernière activité (filtres)

23/07/2026 10:40 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 35 SSH TCP 8

HTTP

SSH

Géolocalisation

Origine réseau déclarée

Pays-Bas unknown unknown

FAI / réseau

Opérateur et dernière activité ban

TechTies Inc. 0 Port 22 ssh_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

Sonde SSH · via SSH:22 · (sonde / probe)

Détails protocole

Bannière SSH: SSH-2.0-libssh_0.12.0 �ŉ>�S�c\:.�5�mlkem768x25519-sha256,mlkem768nis…

Aperçu payload

SSH-2.0-libssh_0.12.0 �ŉ>�S�c\:.�5�mlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sntrup76

Port / service

22 · SSH

Service émulé

SSH

Raison confiance

Confiance 100 % — Motif catalogue confirmé

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

Client SSH libssh/paramiko (scanner) pat-0391 pat-0392 Upstream

Confiance

100%

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

88 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

88 événement(s) — page 1/2

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
23/07/2026 10:40:51 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-libssh_0.12.0 �ŉ>�S�c\:.�5�mlkem768x25519-sh… Émulateur SSH WAF — Recommandation Investiguer Tags net_ssh_probe ssh_banner ssh_emulated ssh_kex_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-libssh_0.12.0 �ŉ>�S�c\:.�5�mlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sn… Payload SSH-2.0-libssh_0.12.0 �ŉ>�S�c\:.�5�mlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sntrup76 Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0391 pat-0392 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) SSH-2.0 banner RFC4253 libssh banner TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-libssh_0.12.0 �ŉ>�S�c\:.�5�mlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sntrup76 Requête brute (extrait) SSH-2.0-libssh_0.12.0 �ŉ>�S�c\:.�5�mlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-ni Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a", "emulator_response_len": 32, "bytes_in": 1287, "payload_entropy": 4.874769339085828, "port_category": "well_known", "org": "TechTies Inc.", "service": "ssh", "app_proto": "ssh", "asn": 197170, "country": "NL", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "matched_patterns": [ "pat-0391", "pat-0392", "pat-0536" ], "matched_pattern_names": [ "SSH-2.0 banner RFC4253", "libssh banner", "TFTP RRQ" ], "pattern_ids": [ "pat-0391", "pat-0392", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "332ce2218db0758eafcb4b08a4f7054d", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-libssh_0.12.0\r\n\u0000\u0000\u0004\ufffd\u0005\u0014\b\u0149>\u0000\ufffdS\ufffdc\\:.\ufffd5\u0018\u0000\u0000\u0001\ufffdmlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sntrup76", "request_sample": "SSH-2.0-libssh_0.12.0\r\n\u0000\u0000\u0004\ufffd\u0005\u0014\b\u0149>\u0000\ufffdS\ufffdc\\:.\ufffd5\u0018\u0000\u0000\u0001\ufffdmlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-ni", "payload_snippet": "SSH-2.0-libssh_0.12.0\r\n\u0000\u0000\u0004\ufffd\u0005\u0014\b\u0149>\u0000\ufffdS\ufffdc\\:.\ufffd5\u0018\u0000\u0000\u0001\ufffdmlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sntrup76", "evidence": { "request_sample": "SSH-2.0-libssh_0.12.0\r\n\u0000\u0000\u0004\ufffd\u0005\u0014\b\u0149>\u0000\ufffdS\ufffdc\\:.\ufffd5\u0018\u0000\u0000\u0001\ufffdmlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-ni", "payload_snippet": "SSH-2.0-libssh_0.12.0\r\n\u0000\u0000\u0004\ufffd\u0005\u0014\b\u0149>\u0000\ufffdS\ufffdc\\:.\ufffd5\u0018\u0000\u0000\u0001\ufffdmlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sntrup76", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "283a77e1c679ee1b9ebd983b38c001096081c6d5", "protocol_details": { "ssh_banner": "SSH-2.0-libssh_0.12.0\r\n\u0000\u0000\u0004\ufffd\u0005\u0014\b\u0149>\u0000\ufffdS\ufffdc\\:.\ufffd5\u0018\u0000\u0000\u0001\ufffdmlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sntrup76", "payload_preview": "SSH-2.0-libssh_0.12.0\r\n\u0000\u0000\u0004\ufffd\u0005\u0014\b\u0149>\u0000\ufffdS\ufffdc\\:.\ufffd5\u0018\u0000\u0000\u0001\ufffdmlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sntrup76", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-libssh_0.12.0\r\n\ufffd\u0149>\ufffdS\ufffdc\\:.\ufffd5\ufffdmlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sntrup76", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0391", "pat-0392", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-libssh_0.12.0\r\n\u0000\u0000\u0004\ufffd\u0005\u0014\b\u0149>\u0000\ufffdS\ufffdc\\:.\ufffd5\u0018\u0000\u0000\u0001\ufffdmlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sntrup76", "payload_preview": "SSH-2.0-libssh_0.12.0\r\n\u0000\u0000\u0004\ufffd\u0005\u0014\b\u0149>\u0000\ufffdS\ufffdc\\:.\ufffd5\u0018\u0000\u0000\u0001\ufffdmlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sntrup76", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-libssh_0.12.0\r\n\ufffd\u0149>\ufffdS\ufffdc\\:.\ufffd5\ufffdmlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,sntrup76", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
05/07/2026 10:22:59 UTC	TCP	21323 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 21323 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.310348199533065, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 21323, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e", "event_fingerprint": "65cfd89e0ec42d030de8a60ec66ce020dd67f325", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "73ece607df923e1c2d16bd467ac08af9", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 21323, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=\r\n\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "473d64df0662b143e4b31da3c3fe3d135bf39e49", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 21323, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "21323" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
05/07/2026 10:17:25 UTC	TCP	21323 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 21323 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic ZGViaWFuOmRlYmlhbg== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.367014211312255, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 21323, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e", "event_fingerprint": "65cfd89e0ec42d030de8a60ec66ce020dd67f325", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e9da7b0576825a7bbb557d50fbb92024", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 21323, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic ZGViaWFuOmRlYmlhbg==\r\n\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic ZGViaWFuOmRlYmlhbg==\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic ZGViaWFuOmRlYmlhbg==", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic ZGViaWFuOmRlYmlhbg==\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic ZGViaWFuOmRlYmlhbg==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "24c75304fad8009150e6e7e2d633ec4cbe9760f0", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic ZGViaWFuOmRlYmlhbg==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 21323, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic ZGViaWFuOmRlYmlhbg==", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "21323" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
05/07/2026 06:41:13 UTC	TCP	4145 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:4145 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 4145 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic cm9vdDptaW50 Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 5.1764055059326886, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 4145, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d7155fae81de512c7b7d514b1aa03dbca2ba0121", "event_fingerprint": "0addff5e18f875f1dbc0861b80681de57cae9622", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d73147ff9529910674389ee88717c033", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 4145, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cm9vdDptaW50\r\n\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cm9vdDptaW50\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cm9vdDptaW50", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cm9vdDptaW50\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cm9vdDptaW50", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "95d37a9c1743ca049f60f3073b2e656576287d02", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 4145, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cm9vdDptaW50", "attack_vector": "Sonde HTTP \u00b7 via HTTP:4145 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "4145 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 4145, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 4145, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:4145 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cm9vdDptaW50", "target_port_label": "4145 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "4145" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
05/07/2026 05:50:15 UTC	TCP	8085 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8085 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8085 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 34, "payload_entropy": 4.219528282299547, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8085, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b7f5690cc43930be753cd0a267cddc9c5ad7c843", "event_fingerprint": "9734d7eb6c30450bf9bc17f1a608bc21863c703b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "05431b5dc6bc04096131e72355300e8d", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3e1394b32c4dad583fc41e8016cd4b286bcc0214", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
05/07/2026 05:49:02 UTC	TCP	8085 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8085 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8085 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 34, "payload_entropy": 4.219528282299547, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8085, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b7f5690cc43930be753cd0a267cddc9c5ad7c843", "event_fingerprint": "9734d7eb6c30450bf9bc17f1a608bc21863c703b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "05431b5dc6bc04096131e72355300e8d", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3e1394b32c4dad583fc41e8016cd4b286bcc0214", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
05/07/2026 05:47:23 UTC	TCP	8085 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8085 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8085 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic cm9vdDo3NzUzMTkx Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.229192305730569, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8085, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b7f5690cc43930be753cd0a267cddc9c5ad7c843", "event_fingerprint": "9734d7eb6c30450bf9bc17f1a608bc21863c703b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "562b6b6258d29624e21b0d9e23b2083c", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cm9vdDo3NzUzMTkx\r\n\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cm9vdDo3NzUzMTkx\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cm9vdDo3NzUzMTkx", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cm9vdDo3NzUzMTkx\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cm9vdDo3NzUzMTkx", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "18c506aa8aa54bf63870c895261f6725bafba225", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cm9vdDo3NzUzMTkx", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cm9vdDo3NzUzMTkx", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
05/07/2026 05:45:38 UTC	TCP	8085 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8085 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8085 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 34, "payload_entropy": 4.219528282299547, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8085, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b7f5690cc43930be753cd0a267cddc9c5ad7c843", "event_fingerprint": "9734d7eb6c30450bf9bc17f1a608bc21863c703b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "05431b5dc6bc04096131e72355300e8d", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3e1394b32c4dad583fc41e8016cd4b286bcc0214", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
05/07/2026 05:44:19 UTC	TCP	8085 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8085 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8085 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 34, "payload_entropy": 4.219528282299547, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8085, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b7f5690cc43930be753cd0a267cddc9c5ad7c843", "event_fingerprint": "9734d7eb6c30450bf9bc17f1a608bc21863c703b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "05431b5dc6bc04096131e72355300e8d", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3e1394b32c4dad583fc41e8016cd4b286bcc0214", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
05/07/2026 05:43:13 UTC	TCP	8085 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8085 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8085 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic YWExMjM6YWExMjM= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 102, "payload_entropy": 5.185515999591614, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8085, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b7f5690cc43930be753cd0a267cddc9c5ad7c843", "event_fingerprint": "9734d7eb6c30450bf9bc17f1a608bc21863c703b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1f115ae505a8b2b4a6670893e77003ec", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic YWExMjM6YWExMjM=\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic YWExMjM6YWExMjM=\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic YWExMjM6YWExMjM=", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic YWExMjM6YWExMjM=\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic YWExMjM6YWExMjM=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e505d298005a2ef5825c7392f48c1ce52a78387c", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic YWExMjM6YWExMjM=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic YWExMjM6YWExMjM=", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
05/07/2026 05:41:03 UTC	TCP	8085 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8085 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8085 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 57, "payload_entropy": 4.354281681928005, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8085, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b7f5690cc43930be753cd0a267cddc9c5ad7c843", "event_fingerprint": "9734d7eb6c30450bf9bc17f1a608bc21863c703b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "01bc475798765d1f55c02700944512e1", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "44650f9027cc7eacf829d45041882f5a7448b8d3", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
05/07/2026 05:38:29 UTC	TCP	8085 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8085 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8085 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic dXNlcjpraWxsZXI= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 102, "payload_entropy": 5.2761543574135406, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8085, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b7f5690cc43930be753cd0a267cddc9c5ad7c843", "event_fingerprint": "9734d7eb6c30450bf9bc17f1a608bc21863c703b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "87162a55dd57b1a335dc185f30192cfe", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjpraWxsZXI=\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjpraWxsZXI=\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjpraWxsZXI=", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjpraWxsZXI=\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjpraWxsZXI=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2c030e009bcc430e5356374fb6fdd4c5ef0246d0", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjpraWxsZXI=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjpraWxsZXI=", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
05/07/2026 05:12:46 UTC	TCP	8085 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8085 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8085 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 57, "payload_entropy": 4.354281681928005, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8085, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b7f5690cc43930be753cd0a267cddc9c5ad7c843", "event_fingerprint": "9734d7eb6c30450bf9bc17f1a608bc21863c703b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "01bc475798765d1f55c02700944512e1", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "44650f9027cc7eacf829d45041882f5a7448b8d3", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
05/07/2026 05:11:25 UTC	TCP	8085 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8085 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8085 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 34, "payload_entropy": 4.219528282299547, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8085, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b7f5690cc43930be753cd0a267cddc9c5ad7c843", "event_fingerprint": "9734d7eb6c30450bf9bc17f1a608bc21863c703b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "05431b5dc6bc04096131e72355300e8d", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3e1394b32c4dad583fc41e8016cd4b286bcc0214", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
05/07/2026 05:10:11 UTC	TCP	8085 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8085 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8085 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic dXNlcjp6YWcxMndzeA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.327526595511419, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8085, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b7f5690cc43930be753cd0a267cddc9c5ad7c843", "event_fingerprint": "9734d7eb6c30450bf9bc17f1a608bc21863c703b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "176e82c1e10d03ede0ea0788a970a8f3", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjp6YWcxMndzeA==\r\n\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjp6YWcxMndzeA==\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjp6YWcxMndzeA==", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjp6YWcxMndzeA==\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjp6YWcxMndzeA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e88ee3c46755e31aa249cfb76ba8866d66e813e5", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjp6YWcxMndzeA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjp6YWcxMndzeA==", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
05/07/2026 05:07:55 UTC	TCP	8085 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8085 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8085 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic cG9zdGdyZXM6cGVwcGVyMQ== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.330568400483875, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 8085, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b7f5690cc43930be753cd0a267cddc9c5ad7c843", "event_fingerprint": "9734d7eb6c30450bf9bc17f1a608bc21863c703b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e9b69d8f39d509db8945152075a857f5", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6cGVwcGVyMQ==\r\n\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6cGVwcGVyMQ==\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6cGVwcGVyMQ==", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6cGVwcGVyMQ==\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6cGVwcGVyMQ==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5281e39cd85a54afeb1d2cf1feeae9c3cd7c573d", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6cGVwcGVyMQ==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6cGVwcGVyMQ==", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 23:50:09 UTC	TCP	2811 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2811 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic dXNlcjo2NTQzMjE= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.231737137523747, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc", "event_fingerprint": "a44f18d1d2f2668d74fadfad9a43043073635166", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c4e94f6b4bdaada942fb01ed10a95121", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 2811, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjo2NTQzMjE=\r\n\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjo2NTQzMjE=\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjo2NTQzMjE=", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjo2NTQzMjE=\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjo2NTQzMjE=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0777425057021f8f0e97865b3895c5d48b33ade3", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjo2NTQzMjE=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2811, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjo2NTQzMjE=", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:2811" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
29/06/2026 23:50:06 UTC	TCP	2811	—	Sonde port Sonde port · port 2811 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2811 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "TechTies Inc.", "service": null, "app_proto": null, "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36", "event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 2811, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "target_port_label": "2811", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 2811, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "2811", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/06/2026 22:13:00 UTC	TCP	2811 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2811 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic c3lzdGVtOjEyMzQ= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.251928151659418, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc", "event_fingerprint": "a44f18d1d2f2668d74fadfad9a43043073635166", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d307c3bc2e43603ec61d9a7eb84a457e", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 2811, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic c3lzdGVtOjEyMzQ=\r\n\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic c3lzdGVtOjEyMzQ=\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic c3lzdGVtOjEyMzQ=", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic c3lzdGVtOjEyMzQ=\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic c3lzdGVtOjEyMzQ=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "eff0facc2e43c62474468891a321ef676507c8cc", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic c3lzdGVtOjEyMzQ=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2811, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic c3lzdGVtOjEyMzQ=", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:2811" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
29/06/2026 22:12:56 UTC	TCP	2811	—	Sonde port Sonde port · port 2811 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2811 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "TechTies Inc.", "service": null, "app_proto": null, "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36", "event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 2811, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "target_port_label": "2811", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 2811, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "2811", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/06/2026 21:40:52 UTC	TCP	2811 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2811 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0 Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.3114586557567005, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc", "event_fingerprint": "a44f18d1d2f2668d74fadfad9a43043073635166", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3600b78264a373a24eebab488c060ee7", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 2811, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0\r\n\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "da616e22267325ae01630cb34ec4d1d9f8f1d8e5", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2811, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:2811" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
29/06/2026 21:40:48 UTC	TCP	2811	—	Sonde port Sonde port · port 2811 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2811 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "TechTies Inc.", "service": null, "app_proto": null, "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36", "event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 2811, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "target_port_label": "2811", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 2811, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "2811", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/06/2026 20:21:05 UTC	TCP	2811 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2811 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.302716476566339, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc", "event_fingerprint": "a44f18d1d2f2668d74fadfad9a43043073635166", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9bbb33c7448bfc6fdb8c3e8cdcad0ffe", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 2811, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=\r\n\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "544df273eca8ce6049ab301b49ff6cff6061bf5e", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2811, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:2811" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
29/06/2026 20:21:02 UTC	TCP	2811	—	Sonde port Sonde port · port 2811 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2811 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "TechTies Inc.", "service": null, "app_proto": null, "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36", "event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 2811, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "target_port_label": "2811", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 2811, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "2811", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/06/2026 17:45:15 UTC	TCP	2811 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2811 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Meta JSON brut { "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 34, "payload_entropy": 4.219528282299547, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc", "event_fingerprint": "a44f18d1d2f2668d74fadfad9a43043073635166", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "05431b5dc6bc04096131e72355300e8d", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 2811, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d57b50e34d366dfb018e92b15b22b87d6b9e4ff6", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2811, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:2811" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
29/06/2026 17:45:14 UTC	TCP	2811	—	Sonde port Sonde port · port 2811 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2811 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "TechTies Inc.", "service": null, "app_proto": null, "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36", "event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 2811, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "target_port_label": "2811", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 2811, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "2811", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/06/2026 16:59:44 UTC	TCP	2811 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2811 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Meta JSON brut { "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 34, "payload_entropy": 4.219528282299547, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc", "event_fingerprint": "a44f18d1d2f2668d74fadfad9a43043073635166", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "05431b5dc6bc04096131e72355300e8d", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 2811, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d57b50e34d366dfb018e92b15b22b87d6b9e4ff6", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2811, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:2811" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
29/06/2026 16:59:42 UTC	TCP	2811	—	Sonde port Sonde port · port 2811 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2811 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "TechTies Inc.", "service": null, "app_proto": null, "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36", "event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 2811, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "target_port_label": "2811", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 2811, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "2811", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/06/2026 15:49:33 UTC	TCP	2811 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2811 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic eWY6eWY= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 94, "payload_entropy": 5.1274082355242205, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc", "event_fingerprint": "a44f18d1d2f2668d74fadfad9a43043073635166", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1737258d6ae5833a09ba0bdd56c47673", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 2811, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic eWY6eWY=\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic eWY6eWY=\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic eWY6eWY=", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic eWY6eWY=\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic eWY6eWY=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f708016efd95464016009d08ddf28b63c458c24c", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic eWY6eWY=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2811, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic eWY6eWY=", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:2811" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
29/06/2026 15:49:30 UTC	TCP	2811	—	Sonde port Sonde port · port 2811 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2811 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "TechTies Inc.", "service": null, "app_proto": null, "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36", "event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 2811, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "target_port_label": "2811", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 2811, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "2811", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/06/2026 12:42:46 UTC	TCP	2811 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2811 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic MTEyMjoxMTIy Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 5.085211351145051, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc", "event_fingerprint": "a44f18d1d2f2668d74fadfad9a43043073635166", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "78b923e561784ead3bb20a2101b27be1", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 2811, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic MTEyMjoxMTIy\r\n\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic MTEyMjoxMTIy\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic MTEyMjoxMTIy", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic MTEyMjoxMTIy\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic MTEyMjoxMTIy", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6b6d144234d248bfbf63e3297c69047f5b51bbf6", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic MTEyMjoxMTIy", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2811, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic MTEyMjoxMTIy", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:2811" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
29/06/2026 12:42:43 UTC	TCP	2811	—	Sonde port Sonde port · port 2811 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2811 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "TechTies Inc.", "service": null, "app_proto": null, "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36", "event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 2811, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "target_port_label": "2811", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 2811, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "2811", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/06/2026 05:14:48 UTC	TCP	2811 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2811 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic amFjazpqYWNr Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 5.189855285612152, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc", "event_fingerprint": "a44f18d1d2f2668d74fadfad9a43043073635166", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "54edc397ebf50616b7012faff2fd57cc", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 2811, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic amFjazpqYWNr\r\n\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic amFjazpqYWNr\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic amFjazpqYWNr", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic amFjazpqYWNr\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic amFjazpqYWNr", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f790cda6d241086ac04f0abb587f47c0430707ae", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic amFjazpqYWNr", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2811, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic amFjazpqYWNr", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:2811" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
29/06/2026 05:14:45 UTC	TCP	2811	—	Sonde port Sonde port · port 2811 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2811 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "TechTies Inc.", "service": null, "app_proto": null, "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36", "event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 2811, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "target_port_label": "2811", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 2811, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "2811", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/06/2026 05:04:14 UTC	TCP	2811 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2811 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic YWRtaW46MTIzMzIx Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.167746541061692, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc", "event_fingerprint": "a44f18d1d2f2668d74fadfad9a43043073635166", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "adbae94a738acdcdb0d8b8512dd76c50", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 2811, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic YWRtaW46MTIzMzIx\r\n\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic YWRtaW46MTIzMzIx\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic YWRtaW46MTIzMzIx", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic YWRtaW46MTIzMzIx\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic YWRtaW46MTIzMzIx", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bc7dc3668fd8db39e611489041187e1f0252e768", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic YWRtaW46MTIzMzIx", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2811, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic YWRtaW46MTIzMzIx", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:2811" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
29/06/2026 05:04:11 UTC	TCP	2811	—	Sonde port Sonde port · port 2811 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2811 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "TechTies Inc.", "service": null, "app_proto": null, "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36", "event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 2811, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "target_port_label": "2811", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 2811, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "2811", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/06/2026 04:52:17 UTC	TCP	2811 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 45.156.87.31:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 45.156.87.31:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2811 Chemin / cible 45.156.87.31:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 45.156.87.31:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Proxy-Authorization: Basic dXNlcjpBYmNkMTIzNA== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.322062794902317, "port_category": "registered", "org": "TechTies Inc.", "service": "http", "app_proto": "http", "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc", "event_fingerprint": "a44f18d1d2f2668d74fadfad9a43043073635166", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d5cb6ff563e13ca67b009f4834d696c4", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "service_name": "http", "target_context": { "dst_port": 2811, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==\r\n\r\n", "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "evidence": { "method": "CONNECT", "path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "request_sample": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==\r\n\r\n", "payload_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2e3d018deef0d793890425a407942124816f2b30", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2811, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "45.156.87.31:80", "request_line": "CONNECT 45.156.87.31:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 45.156.87.31:80", "evidence_snippet": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:2811" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
29/06/2026 04:52:14 UTC	TCP	2811	—	Sonde port Sonde port · port 2811 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2811 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "TechTies Inc.", "service": null, "app_proto": null, "asn": 197170, "country": "NL", "dst_port": 2811, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36", "event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 197170, "org": "TechTies Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 2811, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "target_port_label": "2811", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 2811, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "2811", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
04/06/2026 09:37:14 UTC	TCP	22748	—	proxy probe	Élevée	Faible · 14
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags socks4_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22748 Chemin / cible — Confiance classification 68% Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) P-�W Meta JSON brut { "bytes_in": 9, "payload_entropy": 2.94770277922009, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": null, "app_proto": null, "asn": 51396, "country": "NL", "dst_port": 22748, "risk_waf": 8, "risk_classification": 30, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 8, "classification": 30, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 14, "tag_count": 1, "anomaly_count": 0, "campaign_key": "8e0d63e5edc3a00a033feeefeb165b56e86c40a2", "event_fingerprint": "67c27d77d1be43411630e1fe12ea556055c0d1fa", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b20e127cddd922ca93c25322bf0f8a74", "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3" }, "target_context": { "dst_port": 22748 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "threat_family": [ "scanner" ], "confidence": 0.68, "classification_confidence": 0.68, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "payload_preview": "\u0004\u0001\u0000P-\ufffdW\u001f\u0000", "event_signature": "0d3b5a2b6ce9f26218b1a3770dc8b4af298bd803", "ban_policy": "advisory_monitor", "tags_list": [ "socks4_greeting" ] }
04/06/2026 09:36:54 UTC	TCP	22748	—	proxy probe	Élevée	Faible · 14
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags socks5_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22748 Chemin / cible — Confiance classification 68% Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "bytes_in": 3, "payload_entropy": 1.584962500721156, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": null, "app_proto": null, "asn": 51396, "country": "NL", "dst_port": 22748, "risk_waf": 8, "risk_classification": 30, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 8, "classification": 30, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 14, "tag_count": 1, "anomaly_count": 0, "campaign_key": "deeeba60cd782342d8044d9e2df52b6df9a44061", "event_fingerprint": "67c27d77d1be43411630e1fe12ea556055c0d1fa", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "da075e9d699084fc189cdd233081c49f", "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3" }, "target_context": { "dst_port": 22748 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "threat_family": [ "scanner" ], "confidence": 0.68, "classification_confidence": 0.68, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "payload_preview": "\u0005\u0001\u0000", "event_signature": "133298f4e17b40490f7f463839982a63bc760fbc", "ban_policy": "advisory_monitor", "tags_list": [ "socks5_greeting" ] }
04/06/2026 09:36:54 UTC	TCP	22748	—	Sonde port	Faible	Faible · 14
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
04/06/2026 09:36:34 UTC	TCP	22748	—	Sonde port	Faible	Faible · 14
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
04/06/2026 09:36:33 UTC	TCP	22748	—	proxy probe	Élevée	Faible · 14
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags socks5_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22748 Chemin / cible — Confiance classification 68% Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "bytes_in": 3, "payload_entropy": 1.584962500721156, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": null, "app_proto": null, "asn": 51396, "country": "NL", "dst_port": 22748, "risk_waf": 8, "risk_classification": 30, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 8, "classification": 30, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 14, "tag_count": 1, "anomaly_count": 0, "campaign_key": "deeeba60cd782342d8044d9e2df52b6df9a44061", "event_fingerprint": "67c27d77d1be43411630e1fe12ea556055c0d1fa", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "da075e9d699084fc189cdd233081c49f", "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3" }, "target_context": { "dst_port": 22748 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "threat_family": [ "scanner" ], "confidence": 0.68, "classification_confidence": 0.68, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "payload_preview": "\u0005\u0001\u0000", "event_signature": "133298f4e17b40490f7f463839982a63bc760fbc", "ban_policy": "advisory_monitor", "tags_list": [ "socks5_greeting" ] }
04/06/2026 09:36:13 UTC	TCP	22748	ssh	Sonde SSH	Élevée	Faible · 14
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags ssh_banner ssh_libssh Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22748 Chemin / cible — Confiance classification 71% Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-libssh_0.11.4 Meta JSON brut { "bytes_in": 23, "payload_entropy": 3.8820451081368628, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "ssh", "app_proto": "ssh", "asn": 51396, "country": "NL", "dst_port": 22748, "risk_waf": 8, "risk_classification": 30, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.7, "risk_breakdown": { "waf": 8, "classification": 30, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 14, "tag_count": 2, "anomaly_count": 0, "campaign_key": "8d501194bf759dec62bc8f4709a23182268b463c", "event_fingerprint": "447b6480c887f6987b3e477076629967e0b99052", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "23207ccc4239238861ca89024fcc4096", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22748, "service": "ssh" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "threat_family": [ "scanner" ], "confidence": 0.71, "classification_confidence": 0.71, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "payload_preview": "SSH-2.0-libssh_0.11.4\r\n", "event_signature": "ee69eeee244b5fd8fd841b14f38e3dfe39e40229", "ban_policy": "advisory_monitor", "tags_list": [ "ssh_banner", "ssh_libssh" ] }
04/06/2026 09:36:13 UTC	TCP	22748	—	Sonde port	Faible	Faible · 14
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
04/06/2026 09:35:56 UTC	TCP	22748	http	Sonde HTTP	Élevée	Faible · 16
Étape Sonde / probe MITRE TA0007 TA0001 WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 22748 Chemin / cible 45.156.87.31:80 Confiance classification 74% Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT / HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Meta JSON brut { "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 59, "payload_entropy": 4.360771016449622, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "NL", "dst_port": 22748, "risk_waf": 8, "risk_classification": 30, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 30, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0 }, "risk_score": 16, "tag_count": 3, "anomaly_count": 0, "campaign_key": "064220244b91112b9117adfbd70f54ddb2d4715f", "event_fingerprint": "387ae24159dbc2787f7a2c441adf34eee8ff5105", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ad88fc1a0f9b52045a5e960087bc17a4", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "target_context": { "dst_port": 22748, "service": "http" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\n\r\n", "event_signature": "2d7348c601e7b3cd83e7e21618e617f6b5f14caa", "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
04/06/2026 09:35:56 UTC	TCP	22748	—	Sonde port	Faible	Faible · 14
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
04/06/2026 09:35:40 UTC	TCP	22748	http	Sonde HTTP	Élevée	Faible · 16
Étape Sonde / probe MITRE TA0007 TA0001 WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 45.156.87.31:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 22748 Chemin / cible 45.156.87.31:80 Confiance classification 74% Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT / HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 45.156.87.31:80 HTTP/1.0 Host: 45.156.87.31:80 Meta JSON brut { "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "31:80", "http_ua_hash": null, "http_host_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_target_hash": "d3b9a176f176e1370dc4ea06899a2f77f998a8aa", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 59, "payload_entropy": 4.360771016449622, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": "http", "app_proto": "http", "asn": 51396, "country": "NL", "dst_port": 22748, "risk_waf": 8, "risk_classification": 30, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 30, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 0 }, "risk_score": 16, "tag_count": 3, "anomaly_count": 0, "campaign_key": "064220244b91112b9117adfbd70f54ddb2d4715f", "event_fingerprint": "387ae24159dbc2787f7a2c441adf34eee8ff5105", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ad88fc1a0f9b52045a5e960087bc17a4", "path_pattern_hash": "c147a5195c1f280e82aba58149a129e9" }, "target_context": { "dst_port": 22748, "service": "http" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "payload_preview": "CONNECT 45.156.87.31:80 HTTP\/1.0\r\nHost: 45.156.87.31:80\r\n\r\n", "event_signature": "2d7348c601e7b3cd83e7e21618e617f6b5f14caa", "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
04/06/2026 09:35:36 UTC	TCP	22748	—	Sonde port	Faible	Faible · 14
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
04/06/2026 09:35:23 UTC	TCP	22748	—	proxy probe	Élevée	Faible · 14
Étape Sonde / probe MITRE TA0007 TA0001 WAF — Recommandation Surveiller Tags socks5_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22748 Chemin / cible — Confiance classification 68% Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "bytes_in": 3, "payload_entropy": 1.584962500721156, "port_category": "registered", "org": "Pfcloud UG (haftungsbeschrankt)", "service": null, "app_proto": null, "asn": 51396, "country": "NL", "dst_port": 22748, "risk_waf": 8, "risk_classification": 30, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 8, "classification": 30, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 14, "tag_count": 1, "anomaly_count": 0, "campaign_key": "deeeba60cd782342d8044d9e2df52b6df9a44061", "event_fingerprint": "67c27d77d1be43411630e1fe12ea556055c0d1fa", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 51396, "org": "Pfcloud UG (haftungsbeschrankt)", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "da075e9d699084fc189cdd233081c49f", "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3" }, "target_context": { "dst_port": 22748 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "threat_family": [ "scanner" ], "confidence": 0.68, "classification_confidence": 0.68, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "payload_preview": "\u0005\u0001\u0000", "event_signature": "133298f4e17b40490f7f463839982a63bc760fbc", "ban_policy": "advisory_monitor", "tags_list": [ "socks5_greeting" ] }

45.156.87.31

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence