Détails IP 45.194.92.14

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Tags WAF: sap-sapcontrol-path · confiance 55%

Confiance 55 % — Score WAF 20 · 1 tag(s) WAF

Comparaison ASN / FAI

ASN 215925 · 45.194.92.0/24 · AFRINIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 16 événements sur la période pour cette IP.

45.194.67.52 Flood / DDoS 19/07/2026 22:47 UTC
45.205.1.245 SSRF 19/07/2026 22:45 UTC
45.194.67.63 Cross-site scripting 19/07/2026 22:43 UTC
45.194.67.29 SSRF 19/07/2026 22:40 UTC
45.194.67.51 Flood / DDoS 19/07/2026 22:32 UTC
45.194.67.66 Cross-site scripting 19/07/2026 22:29 UTC
45.194.67.68 Cross-site scripting 19/07/2026 22:25 UTC
45.194.67.57 Cross-site scripting 19/07/2026 22:17 UTC

IPs apparentées

Même FAI Vpsvault.host Ltd — corrélation indicative.

45.194.67.52 Flood / DDoS
45.205.1.245 SSRF
45.194.67.63 Cross-site scripting
45.194.67.29 SSRF
45.194.67.51 Flood / DDoS

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 14 SAP ICM TCP 1 SOCKS5 TCP 1

HTTP

14

SAP ICM

1

SOCKS5

1

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

16 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
19/07/2026 14:47:48 UTC	TCP	8080 · HTTP	http	Sonde port 8080/TCP port 8080 tcp · via HTTP:8080 · (sonde / probe)	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA zmap-proxy-probe/1.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_absolute_uri http_ua_attacktool http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8080 Chemin / cible / Preuve honeypot — Sonde port 8080/TCP Connexion détectée sur le port 8080 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 55% Confiance classification 55% Risque capteur Moyen · 40 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://azenv.net/ HTTP/1.1` User-Agent zmap-proxy-probe/1.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "e4f52cd1d19cf2407fd3d6d61455c19e244a3d00", "http_host_hash": "dcaf26e0226facf068e7ab1be478fce577002459", "http_target_hash": "bf8773fc1c6a90b6cead7677f9e02ac1620a6d79", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "registered", "org": "Vpsvault.host Ltd", "service": "http", "app_proto": "http", "asn": 215925, "country": "US", "dst_port": 8080, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 40, "tag_count": 5, "anomaly_count": 0, "campaign_key": "cabb5668072883a8df0db22f0cfdfb5b8761961f", "event_fingerprint": "85ddff7b192753efa6e29bfe2339fa7fd25a954c", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 40 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "92126d7d3c932fe1ad3c3d0bb464d10d", "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "50786ad3ec665bbcd1bfdc35fc6a290b" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0fbc478925490f974406841f95ddb0b6849ca7aa", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "port 8080 tcp \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 8080 tcp \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_absolute_uri", "http_ua_attacktool", "http_ua_suspicious", "net_web_probe" ] }
19/07/2026 14:24:39 UTC	TCP	8000 · SAP ICM	sap-icm	Sonde SAP ICM HTTP Sonde SAP ICM / WebDynpro · via SAP ICM:8000 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags net_sap_web_probe sap_icm_emulated sap_icm_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Pourquoi cette classification : Type « sap_web_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c", "emulator_response_len": 141, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "registered", "org": "Vpsvault.host Ltd", "service": "sap-icm", "app_proto": "sap-icm", "asn": 215925, "country": "US", "dst_port": 8000, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 38, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15 }, "risk_score": 34, "tag_count": 3, "anomaly_count": 0, "campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc", "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a", "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 34 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "sap_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b0b1498d13cc803ba9ead0c5adf7fd4c36f25365", "protocol_details": { "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 38, "novelty": 15, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_sap_web_probe", "sap_icm_emulated", "sap_icm_payload" ] }
19/07/2026 06:29:27 UTC	TCP	7890 · HTTP	http	Sonde port 7890/TCP port 7890 tcp · via HTTP:7890 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA zmap-proxy-probe/1.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_absolute_uri http_ua_attacktool http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7890 Chemin / cible / Preuve honeypot — Sonde port 7890/TCP Connexion détectée sur le port 7890 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://azenv.net/ HTTP/1.1` User-Agent zmap-proxy-probe/1.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "e4f52cd1d19cf2407fd3d6d61455c19e244a3d00", "http_host_hash": "dcaf26e0226facf068e7ab1be478fce577002459", "http_target_hash": "bf8773fc1c6a90b6cead7677f9e02ac1620a6d79", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "registered", "org": "Vpsvault.host Ltd", "service": "http", "app_proto": "http", "asn": 215925, "country": "US", "dst_port": 7890, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 38, "tag_count": 4, "anomaly_count": 0, "campaign_key": "c20de01d71dcf9fbb0db8ead6ec215b94c9180e8", "event_fingerprint": "998ef7056076a7754d9a7967c468515dcf2991db", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "92126d7d3c932fe1ad3c3d0bb464d10d", "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "50786ad3ec665bbcd1bfdc35fc6a290b" }, "target_context": { "dst_port": 7890, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3e25546291e0f16962cbc9ff6a8476b3291cf08b", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 7890, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "port 7890 tcp \u00b7 via HTTP:7890 \u00b7 (sonde \/ probe)", "target_port_label": "7890 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7890, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 7890, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 7890 tcp \u00b7 via HTTP:7890 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "7890 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7890" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_absolute_uri", "http_ua_attacktool", "http_ua_suspicious" ] }
19/07/2026 02:25:43 UTC	TCP	5678 · HTTP	http	Sonde port 5678/TCP port 5678 tcp · via HTTP:5678 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA zmap-proxy-probe/1.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_absolute_uri http_ua_attacktool http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5678 Chemin / cible / Preuve honeypot — Sonde port 5678/TCP Connexion détectée sur le port 5678 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://azenv.net/ HTTP/1.1` User-Agent zmap-proxy-probe/1.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "e4f52cd1d19cf2407fd3d6d61455c19e244a3d00", "http_host_hash": "dcaf26e0226facf068e7ab1be478fce577002459", "http_target_hash": "bf8773fc1c6a90b6cead7677f9e02ac1620a6d79", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "registered", "org": "Vpsvault.host Ltd", "service": "http", "app_proto": "http", "asn": 215925, "country": "US", "dst_port": 5678, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.2, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 38, "tag_count": 4, "anomaly_count": 0, "campaign_key": "453a3bc6bd01db0bb55f7f4bf8d9d2eb56e346a1", "event_fingerprint": "d77305c97b72352aa83c07c41b3d492b23877c54", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "92126d7d3c932fe1ad3c3d0bb464d10d", "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "50786ad3ec665bbcd1bfdc35fc6a290b" }, "target_context": { "dst_port": 5678, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b96633914633357062cc1045f836be450b32c52c", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 5678, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "port 5678 tcp \u00b7 via HTTP:5678 \u00b7 (sonde \/ probe)", "target_port_label": "5678 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5678, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 5678, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 5678 tcp \u00b7 via HTTP:5678 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "5678 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5678" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_absolute_uri", "http_ua_attacktool", "http_ua_suspicious" ] }
18/07/2026 17:38:47 UTC	TCP	3128 · HTTP	http	Sonde port 3128/TCP port 3128 tcp · via HTTP:3128 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA zmap-proxy-probe/1.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_absolute_uri http_ua_attacktool http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3128 Chemin / cible / Preuve honeypot — Sonde port 3128/TCP Connexion détectée sur le port 3128 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://azenv.net/ HTTP/1.1` User-Agent zmap-proxy-probe/1.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "e4f52cd1d19cf2407fd3d6d61455c19e244a3d00", "http_host_hash": "dcaf26e0226facf068e7ab1be478fce577002459", "http_target_hash": "bf8773fc1c6a90b6cead7677f9e02ac1620a6d79", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "registered", "org": "Vpsvault.host Ltd", "service": "http", "app_proto": "http", "asn": 215925, "country": "US", "dst_port": 3128, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 38, "tag_count": 5, "anomaly_count": 0, "campaign_key": "5b9e984cd9c6ffe9b8e44f2fba8a8e2faa1349b1", "event_fingerprint": "2e006c87c7721ba4e8877168767be9045bd35c8f", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "92126d7d3c932fe1ad3c3d0bb464d10d", "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "50786ad3ec665bbcd1bfdc35fc6a290b" }, "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "776c59cc1084e5c6891dc77f7cc8aa493dd0d21d", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "port 3128 tcp \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe)", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 3128 tcp \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_absolute_uri", "http_ua_attacktool", "http_ua_suspicious", "net_web_probe" ] }
18/07/2026 14:00:17 UTC	TCP	1082 · HTTP	http	Sonde port 1082/TCP port 1082 tcp · via HTTP:1082 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA zmap-proxy-probe/1.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_absolute_uri http_ua_attacktool http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1082 Chemin / cible / Preuve honeypot — Sonde port 1082/TCP Connexion détectée sur le port 1082 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://azenv.net/ HTTP/1.1` User-Agent zmap-proxy-probe/1.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "e4f52cd1d19cf2407fd3d6d61455c19e244a3d00", "http_host_hash": "dcaf26e0226facf068e7ab1be478fce577002459", "http_target_hash": "bf8773fc1c6a90b6cead7677f9e02ac1620a6d79", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "registered", "org": "Vpsvault.host Ltd", "service": "http", "app_proto": "http", "asn": 215925, "country": "US", "dst_port": 1082, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 38, "tag_count": 4, "anomaly_count": 0, "campaign_key": "baf173e2f7bc4748671b401d707004249b3eb4f9", "event_fingerprint": "6cee1717cf71031b5ed52494b04f2cedeea5bb83", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "92126d7d3c932fe1ad3c3d0bb464d10d", "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "50786ad3ec665bbcd1bfdc35fc6a290b" }, "target_context": { "dst_port": 1082, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3a0598b6e36c7b5f8b9331cbd86a9c42f92d1ce2", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 1082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "port 1082 tcp \u00b7 via HTTP:1082 \u00b7 (sonde \/ probe)", "target_port_label": "1082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1082, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 1082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 1082 tcp \u00b7 via HTTP:1082 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "1082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_absolute_uri", "http_ua_attacktool", "http_ua_suspicious" ], "behavior_alert_count": 1, "behavior_priority": 72 }
18/07/2026 12:12:50 UTC	TCP	1081 · HTTP	http	Sonde port 1081/TCP port 1081 tcp · via HTTP:1081 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA zmap-proxy-probe/1.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_absolute_uri http_ua_attacktool http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 1081 Chemin / cible / Preuve honeypot — Sonde port 1081/TCP Connexion détectée sur le port 1081 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://azenv.net/ HTTP/1.1` User-Agent zmap-proxy-probe/1.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "e4f52cd1d19cf2407fd3d6d61455c19e244a3d00", "http_host_hash": "dcaf26e0226facf068e7ab1be478fce577002459", "http_target_hash": "bf8773fc1c6a90b6cead7677f9e02ac1620a6d79", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "registered", "org": "Vpsvault.host Ltd", "service": "http", "app_proto": "http", "asn": 215925, "country": "US", "dst_port": 1081, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 38, "tag_count": 4, "anomaly_count": 0, "campaign_key": "49931a417e7509b7e6d92525800ada2a435fd785", "event_fingerprint": "ba2e5e41f52b1724416b32d121d08349888b2805", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "92126d7d3c932fe1ad3c3d0bb464d10d", "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "50786ad3ec665bbcd1bfdc35fc6a290b" }, "target_context": { "dst_port": 1081, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f9db7d21ccd8ce93f20cde86d199d8a4205c2194", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 1081, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "port 1081 tcp \u00b7 via HTTP:1081 \u00b7 (sonde \/ probe)", "target_port_label": "1081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 1081, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 1081, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 1081 tcp \u00b7 via HTTP:1081 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "1081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "1081" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_absolute_uri", "http_ua_attacktool", "http_ua_suspicious" ] }
18/07/2026 02:40:48 UTC	TCP	1080 · SOCKS5	socks5	socks5 probe socks5 probe · via SOCKS5:1080 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_socks5_probe socks5_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass User-Agent — Règles WAF — Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "protocol_emulated": true, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "registered", "org": "Vpsvault.host Ltd", "service": "socks5", "app_proto": "socks5", "asn": 215925, "country": "US", "dst_port": 1080, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 34, "tag_count": 2, "anomaly_count": 0, "campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5", "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "socks5", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9" }, "target_context": { "dst_port": 1080, "service": "socks5", "service_name": "socks5", "risk_score": 34 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1bdc0e51188d7d495b9c857ab614aac051eacfcf", "protocol_details": { "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "socks5", "service_label_fr": "SOCKS5", "dst_port": 1080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-socks5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "socks5", "service_banner": "honeypot-socks5", "service_os": "linux", "dst_port": "1080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_socks5_probe", "socks5_emulated" ], "behavior_alert_count": 2, "behavior_priority": 84 }
14/07/2026 11:25:24 UTC	TCP	999 · HTTP	http	Sonde port 999/TCP port 999 tcp · via HTTP:999 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA zmap-proxy-probe/1.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_absolute_uri http_ua_attacktool http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 999 Chemin / cible / Preuve honeypot — Sonde port 999/TCP Connexion détectée sur le port 999 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://azenv.net/ HTTP/1.1` User-Agent zmap-proxy-probe/1.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "e4f52cd1d19cf2407fd3d6d61455c19e244a3d00", "http_host_hash": "dcaf26e0226facf068e7ab1be478fce577002459", "http_target_hash": "bf8773fc1c6a90b6cead7677f9e02ac1620a6d79", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "well_known", "org": "Vpsvault.host Ltd", "service": "http", "app_proto": "http", "asn": 215925, "country": "US", "dst_port": 999, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 38, "tag_count": 4, "anomaly_count": 0, "campaign_key": "bee757c35a9e1e6d99a164d485852221421b1f6a", "event_fingerprint": "d0100aaba902ee7b50dd3e36e0ed16462e66afc8", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "92126d7d3c932fe1ad3c3d0bb464d10d", "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "50786ad3ec665bbcd1bfdc35fc6a290b" }, "target_context": { "dst_port": 999, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "094f6873ef3232d7eca39672c326a642e7768f79", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 999, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "port 999 tcp \u00b7 via HTTP:999 \u00b7 (sonde \/ probe)", "target_port_label": "999 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 999, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 999, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 999 tcp \u00b7 via HTTP:999 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "999 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "999" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_absolute_uri", "http_ua_attacktool", "http_ua_suspicious" ] }
12/07/2026 10:19:11 UTC	TCP	9150 · HTTP	http	Sonde port 9150/TCP port 9150 tcp · via HTTP:9150 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA zmap-proxy-probe/1.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_absolute_uri http_ua_attacktool http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9150 Chemin / cible / Preuve honeypot — Sonde port 9150/TCP Connexion détectée sur le port 9150 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://azenv.net/ HTTP/1.1` User-Agent zmap-proxy-probe/1.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "e4f52cd1d19cf2407fd3d6d61455c19e244a3d00", "http_host_hash": "dcaf26e0226facf068e7ab1be478fce577002459", "http_target_hash": "bf8773fc1c6a90b6cead7677f9e02ac1620a6d79", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "registered", "org": "Vpsvault.host Ltd", "service": "http", "app_proto": "http", "asn": 215925, "country": "US", "dst_port": 9150, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.2, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 38, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7fb57c60f42a58045252b4fc130956927471f372", "event_fingerprint": "68c7eb57830c60a534ca9188f9cc4e4e09423155", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "92126d7d3c932fe1ad3c3d0bb464d10d", "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "50786ad3ec665bbcd1bfdc35fc6a290b" }, "target_context": { "dst_port": 9150, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4f74d92cf292fb9e29075dcc311e903b06f86bb6", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 9150, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "port 9150 tcp \u00b7 via HTTP:9150 \u00b7 (sonde \/ probe)", "target_port_label": "9150 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9150, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 9150, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 9150 tcp \u00b7 via HTTP:9150 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "9150 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9150" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_absolute_uri", "http_ua_attacktool", "http_ua_suspicious" ] }
12/07/2026 02:13:56 UTC	TCP	8888 · HTTP	http	Scanner web web scanner · via HTTP:8888 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA zmap-proxy-probe/1.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_absolute_uri http_ua_attacktool http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8888 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 42 Confiance : Confiance 50 % — Motif catalogue confirmé · 1 tag(s) WAF Protocole émulé 1 Signaux pat-0599 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET http://azenv.net/ HTTP/1.1` User-Agent zmap-proxy-probe/1.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "e4f52cd1d19cf2407fd3d6d61455c19e244a3d00", "http_host_hash": "dcaf26e0226facf068e7ab1be478fce577002459", "http_target_hash": "bf8773fc1c6a90b6cead7677f9e02ac1620a6d79", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "registered", "org": "Vpsvault.host Ltd", "service": "http", "app_proto": "http", "asn": 215925, "country": "US", "dst_port": 8888, "risk_waf": 20, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 20, "classification": 42, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 42, "tag_count": 5, "anomaly_count": 0, "campaign_key": "a398df894cbd392c11e23dd75fcd1b8e09706316", "event_fingerprint": "cc46938eab7ad743ae7aa8ebff7f82b95b91653b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0599" ], "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 50%", "confidence_breakdown": { "waf": 20, "classification": 42, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42 }, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "92126d7d3c932fe1ad3c3d0bb464d10d", "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "50786ad3ec665bbcd1bfdc35fc6a290b" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "disclosed_scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1eecfcdee5f65e866046cb1d56bb3fb4bd210297", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "web scanner \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe)", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 50%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 20, "classification": 42, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 42 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "pat-0599" ], "tags_summary_labels_fr": [ "pat-0599" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "web scanner \u00b7 via HTTP:8888 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_absolute_uri", "http_ua_attacktool", "http_ua_suspicious", "net_web_probe" ] }
11/07/2026 17:37:31 UTC	TCP	8881 · HTTP	http	Sonde port 8881/TCP port 8881 tcp · via HTTP:8881 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA zmap-proxy-probe/1.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_absolute_uri http_ua_attacktool http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8881 Chemin / cible / Preuve honeypot — Sonde port 8881/TCP Connexion détectée sur le port 8881 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://azenv.net/ HTTP/1.1` User-Agent zmap-proxy-probe/1.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "e4f52cd1d19cf2407fd3d6d61455c19e244a3d00", "http_host_hash": "dcaf26e0226facf068e7ab1be478fce577002459", "http_target_hash": "bf8773fc1c6a90b6cead7677f9e02ac1620a6d79", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "registered", "org": "Vpsvault.host Ltd", "service": "http", "app_proto": "http", "asn": 215925, "country": "US", "dst_port": 8881, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 38, "tag_count": 4, "anomaly_count": 0, "campaign_key": "6994135e5e67ee39c447941c9bf98598ba9be582", "event_fingerprint": "964657fc19a1693854f95dc90568cbcd9b0f8496", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "92126d7d3c932fe1ad3c3d0bb464d10d", "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "50786ad3ec665bbcd1bfdc35fc6a290b" }, "target_context": { "dst_port": 8881, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b43c6b1ce592d94914e503b03db7f6a07a7e95b4", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 8881, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "port 8881 tcp \u00b7 via HTTP:8881 \u00b7 (sonde \/ probe)", "target_port_label": "8881 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8881, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 8881, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 8881 tcp \u00b7 via HTTP:8881 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "8881 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8881" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_absolute_uri", "http_ua_attacktool", "http_ua_suspicious" ] }
11/07/2026 12:47:23 UTC	TCP	8880 · HTTP	http	Sonde port 8880/TCP port 8880 tcp · via HTTP:8880 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA zmap-proxy-probe/1.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_absolute_uri http_ua_attacktool http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8880 Chemin / cible / Preuve honeypot — Sonde port 8880/TCP Connexion détectée sur le port 8880 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://azenv.net/ HTTP/1.1` User-Agent zmap-proxy-probe/1.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "e4f52cd1d19cf2407fd3d6d61455c19e244a3d00", "http_host_hash": "dcaf26e0226facf068e7ab1be478fce577002459", "http_target_hash": "bf8773fc1c6a90b6cead7677f9e02ac1620a6d79", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "registered", "org": "Vpsvault.host Ltd", "service": "http", "app_proto": "http", "asn": 215925, "country": "US", "dst_port": 8880, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 38, "tag_count": 5, "anomaly_count": 0, "campaign_key": "ae2f637fe4ad2cc70fb0555fe7fbe8a8657eeaa0", "event_fingerprint": "e39bc2a71e19eeef0d0c0d025c7e9f061dda9677", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "92126d7d3c932fe1ad3c3d0bb464d10d", "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "50786ad3ec665bbcd1bfdc35fc6a290b" }, "target_context": { "dst_port": 8880, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1d48ba4dd9f4a929bec0f5962093ee65874f9520", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "port 8880 tcp \u00b7 via HTTP:8880 \u00b7 (sonde \/ probe)", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8880, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 8880, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 8880 tcp \u00b7 via HTTP:8880 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "8880 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_absolute_uri", "http_ua_attacktool", "http_ua_suspicious", "net_web_probe" ] }
11/07/2026 05:57:10 UTC	TCP	8118 · HTTP	http	Sonde port 8118/TCP port 8118 tcp · via HTTP:8118 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA zmap-proxy-probe/1.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_absolute_uri http_ua_attacktool http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8118 Chemin / cible / Preuve honeypot — Sonde port 8118/TCP Connexion détectée sur le port 8118 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://azenv.net/ HTTP/1.1` User-Agent zmap-proxy-probe/1.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "e4f52cd1d19cf2407fd3d6d61455c19e244a3d00", "http_host_hash": "dcaf26e0226facf068e7ab1be478fce577002459", "http_target_hash": "bf8773fc1c6a90b6cead7677f9e02ac1620a6d79", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "registered", "org": "Vpsvault.host Ltd", "service": "http", "app_proto": "http", "asn": 215925, "country": "US", "dst_port": 8118, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 38, "tag_count": 4, "anomaly_count": 0, "campaign_key": "54bf2d8258981d1576ae06963e1a7dfefc7d3eba", "event_fingerprint": "34b1d0b27504710129c5b3298bcd1cb03160e153", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "92126d7d3c932fe1ad3c3d0bb464d10d", "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "50786ad3ec665bbcd1bfdc35fc6a290b" }, "target_context": { "dst_port": 8118, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9441cfa93981d31d168d34be64d9fc1962145615", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 8118, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "port 8118 tcp \u00b7 via HTTP:8118 \u00b7 (sonde \/ probe)", "target_port_label": "8118 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8118, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 8118, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 8118 tcp \u00b7 via HTTP:8118 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "8118 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8118" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_absolute_uri", "http_ua_attacktool", "http_ua_suspicious" ] }
11/07/2026 02:26:27 UTC	TCP	8081 · HTTP	http	Sonde port 8081/TCP port 8081 tcp · via HTTP:8081 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA zmap-proxy-probe/1.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_absolute_uri http_ua_attacktool http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8081 Chemin / cible / Preuve honeypot — Sonde port 8081/TCP Connexion détectée sur le port 8081 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 55% Confiance classification 55% Risque capteur Faible · 38 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://azenv.net/ HTTP/1.1` User-Agent zmap-proxy-probe/1.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "e4f52cd1d19cf2407fd3d6d61455c19e244a3d00", "http_host_hash": "dcaf26e0226facf068e7ab1be478fce577002459", "http_target_hash": "bf8773fc1c6a90b6cead7677f9e02ac1620a6d79", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "registered", "org": "Vpsvault.host Ltd", "service": "http", "app_proto": "http", "asn": 215925, "country": "US", "dst_port": 8081, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 38, "tag_count": 5, "anomaly_count": 0, "campaign_key": "82e6599f58740e8b5ef071fb57ab7bfea748a6f5", "event_fingerprint": "fe7c70dfbca5ca9411bbd11d0c83f3075dc74ee4", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 38 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "92126d7d3c932fe1ad3c3d0bb464d10d", "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "50786ad3ec665bbcd1bfdc35fc6a290b" }, "target_context": { "dst_port": 8081, "service": "http", "service_name": "http", "risk_score": 38 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d254c1edb9efcdd371654f2f28f3d017f79a7e09", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "port 8081 tcp \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe)", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 38 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8081, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 8081 tcp \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8081" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_absolute_uri", "http_ua_attacktool", "http_ua_suspicious", "net_web_probe" ] }
10/07/2026 19:21:25 UTC	TCP	8080 · HTTP	http	Sonde port 8080/TCP port 8080 tcp · via HTTP:8080 · (sonde / probe)	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET / UA zmap-proxy-probe/1.0 Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_absolute_uri http_ua_attacktool http_ua_suspicious Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8080 Chemin / cible / Preuve honeypot — Sonde port 8080/TCP Connexion détectée sur le port 8080 (TCP) du capteur simulé. Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 55% Confiance classification 55% Risque capteur Moyen · 40 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 1 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET http://azenv.net/ HTTP/1.1` User-Agent zmap-proxy-probe/1.0 Règles WAF sap-sapcontrol-path Payload (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connectio Requête brute (extrait) GET http://azenv.net/ HTTP/1.1 Host: azenv.net User-Agent: zmap-proxy-probe/1.0 Accept: / Accept-Encoding: gzip Connection: close Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "e4f52cd1d19cf2407fd3d6d61455c19e244a3d00", "http_host_hash": "dcaf26e0226facf068e7ab1be478fce577002459", "http_target_hash": "bf8773fc1c6a90b6cead7677f9e02ac1620a6d79", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 140, "payload_entropy": 4.852355084664641, "port_category": "registered", "org": "Vpsvault.host Ltd", "service": "http", "app_proto": "http", "asn": 215925, "country": "US", "dst_port": 8080, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 40, "tag_count": 5, "anomaly_count": 0, "campaign_key": "cabb5668072883a8df0db22f0cfdfb5b8761961f", "event_fingerprint": "85ddff7b192753efa6e29bfe2339fa7fd25a954c", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 40 }, "named_classification_skipped": true, "named_candidate": "web_scanner", "service_name": "http", "risk_confidence_factor": 55, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 215925, "org": "Vpsvault.host Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "92126d7d3c932fe1ad3c3d0bb464d10d", "payload_hash": "d0930c51fee071f01a93e7f7991783f5", "path_pattern_hash": "50786ad3ec665bbcd1bfdc35fc6a290b" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "evidence": { "method": "GET", "path": "\/", "user_agent": "zmap-proxy-probe\/1.0", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "request_sample": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n", "payload_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0fbc478925490f974406841f95ddb0b6849ca7aa", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "attack_vector": "port 8080 tcp \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET http:\/\/azenv.net\/ HTTP\/1.1", "http_user_agent": "zmap-proxy-probe\/1.0", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port 8080 tcp \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET http:\/\/azenv.net\/ HTTP\/1.1\r\nHost: azenv.net\r\nUser-Agent: zmap-proxy-probe\/1.0\r\nAccept: \/\r\nAccept-Encoding: gzip\r\nConnectio", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_absolute_uri", "http_ua_attacktool", "http_ua_suspicious", "net_web_probe" ] }

45.194.92.14

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence